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Predefined symbols 



All the predefined symbols can be used in both MASM and Ideal mode. 

$ 

Represents the current location counter within the current segment. 

@32Bit 

Numeric equate indicating whether segments in the current model are declared 
as 16 bit or 32 bit. 

@code 

Alias equate for .CODE segment name. 

@CodeSize 

Numeric equate that indicates code memory model (0=near, l=far). 

@CPU 

Numeric equate that returns information about current processor directive. 

@curseg 

Alias equate for current segment. 

@data 

Alias equate for near data group name. 
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@DataSize 

Numeric equate that indicates the data memory model (0=near, l=far, 2=huge). 

??date 

String equate for today's date. 

@fardata 

Alias equate for initialized far data segment name. 

@fardata? 

Alias equate for uninitialized far data segment name. 

@FileName 

Alias equate for current assembly file name. 

??filename 

String equate for current assembly file name. 

©Interface 

Numeric equate indicating the language and operating system selected by 
MODEL. 

@Model 

Numeric equate representing the model currently in effect. 

©Object 

Text macro containing the name of the current object. 
= Alias equate for stack segment. 



@Stack 



Alias equate for stack segment. 

©Startup 



Label that marks the beginning of startup code. 
@Jdb\Q_<objectname> 



Data type containing the object's method table. 



2 Turbo Assembler Quick Reference 



@TableAdclr_<ofei;ecfnflme> 



Label describing the address of the instance of the object's virtual method table. 

??time 



String equate for the current time. 

??version 



Numeric equate for current Turbo Assembler version number. 

@WordSize 

Numeric equate that indicates 16- or 32-bit segments (2=16-bit, 4=32-bit). 
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Operators 



This chapter covers the operators Turbo Assembler provides and their 
precedence. The two tables that f oUow detail operator precedence for Ideal and 
MASM modes. 

Ideal mode operator precedence 

The following table lists the operators in order of priority (highest is first, lowest 
is last): 

0, [], LENGTH, MASK, OFFSET, SEG, SIZE, WIDTH 

HIGH, LOW 

+, - (unary) 

*, /, MOD, SHL, SHR 

+, - (binary) 

EQ, GE, GT, LE, LT, NE 

NOT 

AND 

OR, XOR 

: (segment override) 

. (structure mem.ber selector) 

HIGH (before pointer), LARGE, LOW (before pointer), PTR, SHORT, 
SMALL, SYMTYPE 

MASM mode operator precedence 

• <,(),[], LENGTH, MASK, SIZE, WIDTH 

• . (structure member selector) 

• HIGH, LOW 
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+, - (unary) 

: (segment override) 

OFFSET, PTR, SEG, THIS, TYPE 

*,/,MOD,SHL,SHR 

+, - (binary) 

EQ, GE, GT, LE, LT, NE 

NOT 

AND 

OR, XOR 

LARGE, SHORT, SMALL, .TYPE 



Operators 



( ) Ideal, MASM 



(expression) 

Marks expression for priority evaluation. 



Ideal, MASM 



express! on 1 * expression2 

Multiplies two integer expressions. Also used with 80386 addressing modes 
where one expression is a register. 

+ (binary) ideal, masm 

expression 1 + expression2 
Adds two expressions. 

+ (unary) ideal, masm 

+ expression 

Indicates that expression is positive. 

- (binary) ideal, masm 

expression 1 - expression2 
Subtracts two expressions. 

- (unary) ideal, masm 

-expression 

Changes the sign of expression. 
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._ Ideal, MASM 

memptr.fieldname 

Selects a structure member. 

/ Ideal, MASM 

expressioni I expression2 
Divides two integer expressions. 

Ideal, MASM 



segorgroup : expression 

Generates segment or group override. 



Ideal, MASM 



Dx? 

Irutializes with indeterminate data (where Dx is DB, DD, DF, DP, DQ, DT, or 
DW). 

y Ideal, MASM 

expression 1[expression2\ 

[expression 1][expression2\ 

MASM mode: The [ ] operator can be used to specify addition or register 
indirect memory operands. Ideal mode: The [ ] operator specifies a memory 
reference. 

AND Ideal, MASM 

expressioni AND expressionZ 

Performs a bit-by-bit logical AND of two expressions. 

BYTE Ideal 

BYTE expression 

Forces address expression to be byte size. 

BYTE PTR Ideal, MASM 

BYTE PTR expression 

Forces address expression to be byte size. 

CODEPTR Ideal, MASM 

CODEPIR expression 

Returns the default procedure address size. 
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DATAPTR id«i 

DAI kPTR expression 

Forces address expressiori to model-dependent size. 

PUP Ideal, MASM 

count DUP (expression [,expression]...) 

Repeats a data allocation operation count times. 

DWORD Ideal 

DWORD expression 

Forces address expression to be doubleword size. 

DWORD PTR Ideal, MASM 

DWORD PTR expression 

Forces address expression to be doubleword size. 

EQ Ideal, MASM 

expression 1 EQ expression2 

Returns true if expressions are equal. 

FAR Ideal 

FAR expression 

Forces an address expression to be a far code pointer. 

FAR PTR Ideal, MASM 

FAR PTR expression 

Forces an address expression to be a far code pointer. 

FWORD Ideal 

FWORD expression 

Forces address expression to be 32-bit far pointer size. 

FWORD PTR Ideal, MASM 

FWORD PTR expression 

Forces address expression to be 32-bit far pointer size. 
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GE Ideal, MASM 

expressioni GE expression2 

Returns true if one expression is greater than or equal to the other. 

GT Ideal, MASM 

expressioni GT expression2 

Returns true if one expression is greater than the other. 

HIGH Ideal, MASM 

HIGH expression 

Returns the high part (8 bits or type size) of expression. 

HIGH Ideal 

type HIGH expression 

Returns the high part (8 bits or type size) of expression. 

LARGE Ideal, MASM 

LARGE expression 

Sets expression's offset size to 32 bits. In Ideal mode, this operation is legal only if 
386 code generation is enabled. 

LE Ideal, MASM 

expressioni LE expressionZ 

Returns true if one expression is less than or equal to the other. 

LENGTH Ideal, MASM 

LENGTH name 

Returns number of data elements allocated as part of name. 

LOW Ideal, MASM 

LOW expression 

Returns the low part (8 bits or type size) of expression. 

LOW Ideal 

type LOW expression 

Returns the low part (8 bits or type size) of expression. 
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LT Ideal, MASM 

expression 1 LT expression2 

Returns true if one expression is less than the other. 

MASK Ideal, MASM 

MASK recordfieldname 
MASK record 

Returns a bit mask for a record field or an entire record. 

MOD Ideal, MASM 

expressioni MOD expression2 

Returns remainder (modulus) from dividing two expressions. 

NE Ideal, MASM 

expressmi NE expression2 

Returns true if expressions are not equal. 

NEAR Ideal 

NEAR expression 

Forces an address expression to be a near code pointer. 

NEAR PTR Ideal, MASM 

NEAR PTR expression 

Forces an address expression to be a near code pointer. 

NOT Ideal, MASM 

NOT expression 

Performs a bit-by-bit complement (invert) of expression. 

OFFSET Ideal, MASM 

OFFSET expression 

Returns the offset of expression within the current segment (or the group that the 
segment belongs to, if using simplified segmentation directives or Ideal mode). 

OR Ideal, MASM 

expressioni OR expression2 

Performs a bit-by-bit logical OR of two expressions. 
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PROC 

PROC expression 

Forces an address expressior\ to be a near or far code pointer. 

PROC PTR 



PTR 



Ideal 



Ideal, MASM 



PROC PTR expression 

Forces an address expression to be a near or far code pointer. 



Ideal, MASM 



type PTR expression 

Forces address expression to have type size. 

PWORD 



PWORD PTR 



QWORD 



Ideal 



PWORD expression 

Forces address expression to be 32-bit far pointer size. 



Ideal, MASM 



PWORD PTR expression 

Forces address expression to be 32-bit far pointer size. 



Ideal 



QWORD expression 

Forces address expression to be quadword size. 

QWORD PTR 



Ideal, MASM 



QWORD PTR expression 

Forces address expression to be quadword size. 

SEG 



Ideal, MASM 



SEG expression 

Returns the segment address of an expression that references memory. 



SHL 



Ideal, MASM 



expression SHL count 

Shifts the value of expression to the left count bits. A negative count causes the 
data to be shifted the opposite way. 
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SHORT Ideal. MASM 

SHORT expression 

Forces expression to be a short code pointer (within -128 to +127 bytes of the 
current code location). 

SHR Ideal, MASM 

expression SHR count 

Shifts the value of expression to the right count bits. A negative count causes the 
data to be shifted the opposite way. 

SIZE Ideal, MASM 

SIZE name 

Returns size of data item allocated with name. In MASM mode, SIZE returns 
the value of LENGTH name multiplied by TYPE name. In Ideal mode, SIZE 
returns the byte count within name's DUP. 

SMALL Ideal, MASM 

SMALL expression 

Sets expression's offset size to 16 bits, hi Ideal mode, this operation is legal only if 
386 code generation is enabled. 

SYMTYPE Ideal 

SYMTYPE 

Returns a byte describing expression. 

TBYTE Ideal 

TBYTE expression 

Forces address expression to be 10-byte size. 

TBYTE PTR ideal, masm 

JByJEPJR expression 

Forces address expression to be 10-byte size. 

THIS Ideal, MASM 

THIS type 

Creates an operand whose address is the current segment and location coimter. 
type describes the size of the operand and whether it refers to code or data. 
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.TYPE MASM 

TYPE expression 

Returns a byte describing the mode and scope of expression. 

TYPE IDEAL 

TYPE name1 name2 

Applies the type of an existing variable or structure member to another variable 
or structure member. 

TYPE MASM 

TYPE expression 

Returns a niimber indicating the size or type of expression. 

UNKNOWN Weal 

UNKNOWN expression 

Removes type information from address expression. 

WIDTH Ideal, MASM 

WIDTH recordfieldname 
WIDTH record 

Returns the width in bits of a field in a record, or of an entire record. 

WORD Ideal 

WORD expression 

Forces address expression to be word size. 

WORDPTR Ideal, MASM 

WORD PTR expression 

Forces address expression to be word size. 

XOR Ideal, MASM 

expression^ XOR expression2 

Performs bit-by-bit logical exclusive OR of two expressions. Unconditional 
page break inserted for print formatting 
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Macro operators 



& Ideal, MASM 

&.name 

Substitutes actual value of macro parameter name. 

<> Ideal, MASM 

Treats text literally, regardless of any special characters it might contaiii. 



I 



Ideal, MASM 



{character 

Treats character literally, regardless of any special meaning it might otherwise 
have. 

% Ideal, MASM 

%text 

Treats text as an expression, computes its value and replaces text with the result. 
text may be either a numeric expression or a text equate. 

]] Ideal, MASM 

;;comment 

Suppresses storage of a comment in a macro definition. 



Run-time operators 



The following operators are evaluated at run time, and can only be used inside 
.IF, .REPEAT, and .WHILE loops. These operators are valid only in MASM 
mode. 



MASM 



expression! == expression! 

Returns true when expression! is equal to expression!. 

I- 



MASM 



expression! != expression! 

Returns true when expression! is not equal to expression!. 



MASM 



expression! > expression! 

Returns true when expression! is greater than expression!. 
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>= MASM 

expression! >= expression! 

Returns true when expression! is greater than or equal to expression!. 

< MASM 

expression! < expression! 

Returns true when expression! is less than expression!. 

<= MASM 

expression! <= expression! 

Returns true when expression! is less than or equal to expression!. 

II MASM 

expression! I I expression! 

Returns the logical ORed value of expression! and expression!. 

&& MASM 

expression! && expression! 

Returns the logical ANDed value of expression! and expression!. 

& MASM 

expression! & expression! 

Returns the bitwise ANDed value of expression! and expression!. 



I 



MASM 



lexpression 

Returns the logical negation of expression. 



CARRY? 


MASM 


Returns the status of the carry flag. 




OVERFLOW? 


MASM 


Returns the status of the overflow flag. 




PARITY? 


MASM 



Returns the status of the parity flag. 
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SIGN? MASM 

Returns the status of the sign flag. 

ZERO? . MASM 

Returns the status of the zero flag. 
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Chapter 



Directives 



■186 MASM 

.186 

Enables assembly of 80186 processor instructions. 

■286 MASM 

.286 

Enables assembly of non-privileged (real mode) 80286 processor instiixictions 
and 80287 numeric coprocessor instiructions. 

■286C MASM 

.286c 

Enables assembly of non-privileged (real mode) 80286 processor instiructions 
and 80287 numeric coprocessor insti-uctions. 

■286P MASM 

.286P 

Enables assembly of all 80286 (including protected mode) processor 
instructions and 80287 numeric coprocessor instructions. 

■287 MASM 

.287 

Enables assembly of 80287 numeric coprocessor instructions. 
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■386 MASM 

.386 

Enables assembly of non-privileged (real mode) 80386 processor instructions 
and 80387 numeric coprocessor instiructions. 

■386C MASM 

.386C 

Enables assembly of non-privileged (real mode) 80386 processor instructions 
and 80387 riumeric coprocessor instructions. 

.386P MASM 

.386P 

Enables assembly of all 80386 (including protected mode) processor 
instructions and 80387 numeric coprocessor instructions. 

■387 MASM 

.387 

Enables assembly of 80387 numeric coprocessor instructions. 

.486 MASM 

.486 

Enables assembly of non-privileged (real mode) instructions for the i486 
processor. 

■486C MASM 

.486C 

Enables assembly of non-privileged (real mode) instructions for the i486 
processor. 

■486P MASM 

.486P 

Enables assembly of protected mode instructions for the i486 processor. 

■487 MASM 

.487 

Enables assembly of 80487 numeric processor instiuctions. 
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■586 MASM 

.586 

Enables assembly of non-privileged (real mode) instructions for the 
Pentium processor. 

.586C MASM 

.586C 

Enables assembly of non-privileged (real mode) instructions for the 
Pentium processor. 

.586P MASM 

.586P 

Enables assembly of protected mode instructions for the Pentium processor. 

.587 MASM 

.587 

Enables assembly of Pentium numeric processor instiuctions. 

■8086 MASM 

.8086 

Enables assembly of 8086 processor instructions only. This is the default 
processor instruction mode used by Turbo Assembler. 

■8087 MASM 

.8087 

Enables assembly of 8087 ntimeric coprocessor instructions only. This is the 
default coprocessor instruction mode used by Turbo Assembler. 

I Ideal, MASM 

name: 

Defines a near code label called name. 



= Ideal, MASM 

name = expression 

Defines or redefines a numeric equate. 

ALIGN Ideal, MASM 

ALIGN boundary 

Rounds up the location counter to a power-of-two address boundary (2, 4,8, ...). 
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■ALPHA MASM 

.ALPHA 

Sets alphanumeric segment-ordering. The /a command-line option performs 
the same function. 

ALIAS _^_^___ Ideal, MASM 

ALIAS <alias_name>=<target_name> 

Allows the association of an alias name with a particular target name. When the 
linker encounters an alias name, it resolves the alias by referring to the target 
name. 

Note: The syntax for ALIAS is identical in both Ideal and MASM modes. 

ARG Ideal, MASM 

ARG argument [,argumen{\ ... [=symbol\ 
[REJURHS argument largumenf\] 

Sets up arguments on the stack for procedures. Each argument is assigned a 
positive offset from the BP register, presuming that both the return address of 
the procedure call and the caller's BP have been pushed onto the stack already. 
Each argument has the following syntax (boldface items are literal): 

argname [[countt]] [:[debug_size] [type] [:count2]] 

The optional debug_size has this syntax: 

[type] PTR 

ASSUME Ideal, MASM 

ASSUME segmentreg-.name [,segmentreg:name]... 

ASSUME segmentreg:mJH\HG 

ASSUME NOTHING 

Specifies the segment register (segmentreg) that will be used to calculate the 
effective addresses for all labels and variables defined under a given segment or 
group name (name). The NOTHING keyword cancels the association between 
the designated segment register and segment or group name. The ASSUME 
NOTHING statement removes all associations between segment registers and 
segment or group names. . 

In addition, MASM mode supports the following syntax, which uses ASSUME 
to assign a data type to a data register: 

ASSUME dataregitype [,datareg:type] 

%BIN Ideal, MASM 

%BIN size 

Sets the width of the object code field in the listing file to size columns. 
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■BREAK MASM 

.BREAK [.IF expression] 

This directive generates code that terminates a .WHILE or .REPEAT block if the 
expression evaluates true. 

BYTE MASM 

[name] BYTE expression [,expression]... 

Allocates and initializes a byte of storage. Synonymous with DB. 

CALL Ideal, MASM 

CALL<;nstencejDfr>METHOD{od/ect_A?a/77e>:} 
<methocl_name>{USES{segreg-]offsreg}{<extended_caiij)arameters>} 

Calls a method procedure. 

CATSTR Ideal, MASM51 

name CATSTR string [,string]... 

Concatenates several strings to form a single string name. 

■CODE MASM 

.CODE [name] 

Synonymous with CODESEG. MASM mode only. 

CODESEG Ideal, MASM 

CODESEG [name] 

Defines the start of a code segment when used with the .MODEL directive. If 
you have specified the meditim or large memory model, you can follow the 
.CODE (or CODESEG) directive with an optional name that indicates the name 
of the segment. 

COMM Ideal, MASM 

COMM definition [,definition]... 

Defines a communal variable. Each definition describes a symbol and has the 
following forniat (boldface items are literal): 

[distance] [language] symbolnamei [ counti ] ]:type [:count2] 

distance can be either NEAR or FAR and defaults to the size of the default data 
memory model if not specified, language is either C, PASCAL, BASIC, 
FORTRAN, PROLOG, or NOLANGUAGE and defines any language-specific 
conventions to be appHed to symbolname. symbolname is the commimal sjnnbol 
(or symbols, separated by commas). If distance is NEAR, the linker uses counti 
to calculate the total size of the array. If distance is FAR, the linker uses counti to 
indicate how m.any elements there are of size counti times the basic element size 
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(determined by type), type can be one of the following: BYTE, WORD, 
DATAPTR, CODEPTR, DWORD, FWORD, PWORD, QWORD, TBYTE, or a 

structure name, count! specifies how many items this communal s5nnbol 
defines. Both countl and count! default to 1. 

COMMENT MASM 

COMMENT QfeMter[tex/| 
[texfi 
[texf^ delimiter [texf\ 

Starts a multiline comment, delimiter is the first non-blank character following 
COMMENT. 

%CONDS Ideal, MASM 

%CONDS 

Shows all statements in conditional blocks in the listing. 

■CONST ^ MASM 

.CONST 

Defines the start of the constant data segment. Synonymous with CONST. 
MASM mode only. 

CONST Ideal, MASM 

CONST 

Defines the start of the constant data segment. 

■CONTINUE MASM 

.CONTINUE [.IF expression] 

This directive generates code that jumps to the top of a .WHILE or .REPEAT 
block if the expression evaluates true. 

■CREF MASM 

.CREF 

Synonymous with %CREF. MASM mode only. 

%CREF Ideal, MASM 

%CREF 

Allows cross-reference information to be accumulated for all symbols 
encountered from this point forward in the source file. .CREF reverses the effect 
of any %XCREF or .XCREF directives that inhibited the information collection. 
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%CREFALL Ideal, MASM 

%CREFALL 

Causes all subsequent symbols in the source file to appear in the cross-reference 
listing. This is the default mode for Turbo Assembler. %CREFALL reverses the 
effect of any previous %CREFREF or %CREFUREF directives that disabled the 
listing of unreferenced or referenced symbols. 

%CREFREF Ideal, MASM 

%CREFREF 

Disables listing of imreferenced symbols in cross-reference. 

%CREFUREF ideal, masm 

%CREFUREF 

Lists ordy the unreferenced symbols in cross-reference. 

%CTLS Ideal, MASM 

%CTLS 

Causes listing control directives (such as %LIST, %INCL, and so on) to be 
placed in the listing file. 

■DATA MASM 

.DATA 

Synonymous with DATASE6. MASM mode only. 

DATASEG Ideal 

DATASEG 

Defines the start of the initialized data segment in your module. You must first 
have used the .MODEL directive to specify a memory model. The data segment 
is put in a group called DGROUP, which also contains the segments defined 
with the .STACK, .CONST, and .DATA? directives. 

■DATA? MASM 

.DATA? 

Defines the start of the uninitialized data segment in your module. You must 
first have used the .MODEL directive to specify a memory model. The data 
segment is put in a group called DGROUP, which also contains the segments 
defined with the .STACK, .CONST, and .DATA directives. 
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DB Ideal, MASM 

[name] DB expression [,expression]... 

Allocates and initializes a byte of storage, name is the symbol you'll 
subsequently use to refer to the data, expression can be a constant expression, a 
question mark, a character string, or a DUPlicated expression. 

DP Ideal, MASM 

[name] DD [type PTR] expression [,expression]... 

Allocates and initializes 4 bytes (a doubleword) of storage, name is the symbol 
you'll subsequently use to refer to the data, type followed by PTR adds debug 
information to the symbol being defined, so that Turbo Debugger can display 
its contents properly, type is one of the following: BYTE, WORD, DATAPTR, 
CODEPTR, DWORD, FWORD, PWORD, QWORD, TBYTE, SHORT, NEAR, 
FAR or a structure name, expression can be a constant expression, a 32-bit 
floating-point number, a question mark, an address expression, or a 
Duplicated expression. 

%DEPTH Ideal, MASM 

%DEPTH width 

Sets size of depth field in listing file to width columns. The default is 1 column. 

DF ideal, MASM 

[name] DF [type PTR] expression [,expression]... 

Allocates and initializes 6 bytes (a far 48-bit pointer) of storage, name is the 
symbol you'll subsequently use to refer to the data, type followed by PTR adds 
debug information to the symbol being defined, so that Turbo Debugger can 
display its contents properly, type is one of the following: BYTE, WORD, 
DATAPTR, CODEPTR, DWORD, FWORD, PWORD, QWORD, TBYTE, 
SHORT, NEAR, FAR or a structure name, expression can be a constant 
expression, a question mark, an address expression, or a DUPlicated 
expression. 

DISPLAY Ideal, MASM 

DISPLAY "texf 

Outputs a quoted string (text) to the screen. 

DOSSEG Ideal, MASM 

DOSSEG 

Enables DOS segment-ordering at link time. DOSSEG is included for 
backward compatibility only. 



24 Turbo Assembler Quick Reference 



DP Ideal, MASM 

[name] DP [type PTR] expression [,expression]... 

Allocates and initializes 6 bytes (a far 48-bit pointer) of storage, name is the 
symbol you'll subsequently use to refer to the data, type followed by PTR adds 
debug information to the sym.bol being defined, so that Turbo Debugger can 
display its contents properly, type is one of the following: BYTE, WORD, 
DATAPTR, CODEPTR, DWORD, FWORD, PWORD, QWORD, TBYTE, 
SHORT, NEAR, FAR or a structure name, expression can be a constant 
expression, a question mark, an address expression, or a DUPlicated 
expression. 

DO Ideal, MASM 

[name] DQ expression [,expression]... 

Allocates and initializes 8 bytes (a quadword) of storage, name is the symbol 
you'll subsequently use to refer to tiie data, expression can be a constant 
expression, a 64-bit floating-pokit niimber, a question mark, or a DUPlicated 
expression. 

DT Ideal, MASM 

[name] DJ expression [,expression]... 

Allocates and initializes 10 bytes of storage, name is the symbol you'll 
subsequently use to refer to the data, expression can be a constant expression, a 
packed decimal constant expression, a question mark, an 80-bit floating-point 
number, or a DUPlicated expression. 

DW Ideal, MASM 

[name] DW [type PTR] expression [,expression]... 

Allocates and initializes 2 bytes (a word) of storage, name is the symbol you'll 
subsequently use to refer to the data, type followed by PTR adds debug 
information to the symbol being defined, so that Turbo Debugger can display 
its contents properly, type is one of the following: BYTE, WORD, DATAPTR, 
CODEPTR, DWORD, FWORD, PWORD, QWORD, TBYTE, SHORT, NEAR, 
FAR or a structure name, expression can be a constant expression, a question 
mark, an address expression, or a DUPlicated expression. 

DWORD MASM 

[name] DWORD [type PTR] expression [,expression]... 

Allocates and initializes a doubleword (4 bytes) of storage. Synonymous with 
DD. 

ECHO MASM 

ECHOtexf 

Displays the message text to the standard output device (the screen, by default). 
Synonymous with %OUT and DISPLAY. 
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ELSE Ideal, MASM 

IF condition 

statementsi 
[ELSE 

statements2\ 
ENDIF 

Starts an alternative IF conditional assembly block. The statements introduced 
by ELSE {statements!) are assembled if condition evaluates to false. 

■ELSE MASM 

.IF condition 

statementsi 
[.ELSE 

statements2l 
.ENDIF 

Starts an alternative .IF conditional assembly block. The statements introduced 
by .ELSE (statementsi) are executed if condition evaluates to false. 

ELSEIF Ideal, MASM 

IF conditio n1 

statementsi 
[ELSEIF condition2 

statements2\ 
ENDIF 

Starts nested conditional assembly block if condition! is true. Several other 
forms of ELSEIF are supported: ELSEIFl, ELSEIF2, ELSEIFB, ELSEIFDEF, 
ELSEIFDIF, ELSEIFDIFI, ELSEIFE, ELSEIFIDN, ELSEIFIDNI, ELSEIFNB, 
and ELSEIFNDEF. 

EMUL , Ideal, MASM 

EMUL 

Causes all subsequent numeric coprocessor instructions to be generated as 
emulated instructions, instead of real instructions. When your program is 
executed, you must have a software floating-point emulation package installed 
or these instructions will not work properly. 

END ideal, MASM 

END [startaddress] 

Marks the end of a source file, startaddress is a symbol or expression that 
specifies the address in your program where you want execution to begin. 
Turbo Assembler ignores any text that appears after the END directive. 
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ENDIF Ideal, MASM 

IFx condition 

statements 
ENDIF 

Marks the end of a conditional assembly block started with one of the IF 
directives. 

.ENDIF MASM 

.IF condition 

statements 
.ENDIF 

Marks the end of a conditional assembly block started with the .IF directive. 

ENDM Ideal, MASM 

ENDM 

Marks the end of a repeat block or a macro definition. 

ENDP Ideal, MASM 

ENDP [procname] 

[procname] ENDP 

Marks the end of a procedure. If procname is supplied, it must match the 
procedure name specified with the PROC directive that started the procedure 
definition. 

ENDS Ideal, MASM 

ENDS [segmentname \ strucname] 

[segmentname | strucname] ENDS 

Marks end of current segment, structure or imion. If you supply the optional 
name, it must match the name specified with the corresponding SEGMENT, 
STRUC, or UNION directive. 

.ENDW MASM 

.WHILE expression 

statements 
.ENDW 

Marks the end of a conditional assembly block started with the .WHILE 
directive. 



Chapter 3, Directives 27 



ENUM Ideal, MASM 

ENUM nam^enum_vai[,enum_var...]] 
name ENUM [enum_vai[,enum_var...]] 
Declares an entimerated data type. 

EQU ideal, MASM 

name EQU expression 

Defines name to be a string, alias, or numeric equate containing the result of 
evaluating expression. 

■ERR MASM 

.ERR <string> 

Synonymous with ERR. MASM mode only. 

ERR Ideal, MASM 

ERR <string> 

Forces an error to occur at the line that this directive is encountered on in the 
source file. The optional string will display as part of the error message. 

■ERR1 MASM 

.ERR1 <string> 

Forces an error to occur on pass 1 of assembly. The optional string will display 
as part of the error message. 

■ERR2 MASM 

.ERR2 <string> 

Forces an error to occur on pass 2 of assembly if multiple-pass mode (controlled 
by /m command-line option) is enabled. The optional string will display as part 
of the error message. 

■ERRB MASM 

.ERRB argument <string> 

Forces an error to occur if argument is blank (empty). The optional string will 
appear as part of the error message. 

■ERRDEF _^ MASM 

.ERRDEF symbol <string> 

Forces an error to occur if symbol is defined. The optional string will appear as 
part of the error message. 
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■ERRDIF MASM 

.ERRDIF argument1,argument2 <string> 

Forces an error to occur if arguments are different. The comparison is case 
sensitive. The optional string will appear as part of the error message. 

■ERRDIFI MASM 

.ERRDIFI argumenti ,argument2 <string> 

Forces an error to occur if arguments are different. The comparison is not case 
sensitive. The optional string will appear as part of the error message. 

■ERRE MASM 

.ERRE expression <string> 

Forces an error to occur if expression is false (0). The optional string will appear 
as part of the error message. 

■ERRIDN MASM 

■ERRIDN argumenti ,argument2 <string> 

Forces an error to occur if arguments are identical. The comparison is case 
sensitive. The optional string will appear as part of the error niessage. 

■ERRIDNI MASM 

.ERRIDNI argumenti, argument2 <string> 

Forces an error to occur if arguments are identical. The comparison is not case 
sensitive. The optional string will appear as part of the error message. 

ERRIF Ideal, MASM 

ERRIF expression <string> 

Forces an error to occur if expression is true (nonzero). The optional string will 
appear as part of the error message. 

ERRIF1 Ideal, MASM 

ERRIF1 <string> 

Forces an error to occur on pass 1 of assem^bly. The optional string will appear 
as part of the error message. 

ERRIF2 Ideal, MASM 

ERRIF2 <string> 

Forces an error to occur on pass 2 of assembly if multiple-pass mode (controlled 
by /m command-line option) is enabled. The optional string will appear as part 
of the error message. 



Chapter 3, Directives 29 



ERRIFB Ideal, MASM 

ERRIFB argument <string> 

Forces an error to occur if argument is blank (empty). The optional string will 
appear as part of the error message. 

ERRIFDEF ideal, MASM 

ERRIFDEF symbol <string> 

Forces an error if symbol is defined. The optional string will appear as part of the 
error message. 

ERRIFDIF Ideal, MASM 

ERRIFDIF argumenti ,argument2 <string> 

Forces an error to occur if arguments are different. The comparison is case 
sensitive. The optional string will appear as part of the error message. 

ERRIFDIFI Ideal, MASM 

ERRIFDIFI argumenti ,argument2 <string> 

Forces an error to occur if arguments are different. The comparison is not case 
sensitive. The optional string will appear as part of the error message. 

ERRIFE Ideal, MASM 

ERRIFE expression <string> 

Forces an error if expression is false (0). The optional string will appear as part of 
the error message. 

ERRIFIDN Ideal, MASM 

ERRIFIDN argumenti, argument2 <string> 

Forces an error to occur if arguments are identical. The comparison is case 
sensitive. The optional string will appear as part of the error message. 

ERRIFIDNI Ideal, MASM 

ERRIFIDNI argumenti ,argument2 <string> 

Forces an error to occur if arguments are identical. The comparison is not case 
sensitive. The optional string will appear as part of the error message. 

ERRIFNB Ideal, MASM 

ERRIFNB argument <string> 

Forces an error to occur if argument is not blank. The optional string will appear 
as part of the error message. 
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ERRIFNDEF ideal, masm 

ERRIFNDEF symbol <string> 

Forces an error to occur if symbol is not defined. The optional string will appear 
as part of the error message. 

.ERRNB MASM 

.ERRNB argument <string> 

Forces an error to occur if argument is not blank. The optional string will appear 
as part of the error niessage. 

■ERRNDEF masm 

.ERRNDEF symbol <string> 

Forces an error to occur if symbol is not defined. The optional string will appear 
as part of the error message. 

■ERRNZ masm 

.ERRNZ expression <string> 

Forces an error to occur if expression is true (nonzero). The optional string will 
appear as part of the error message. 

EVEN Ideal, MASM 

EVEN 

Roim.ds up the location counter to the next even address. 

EVENDATA ideal, masm 

EVENDATA 

Roxmds up the location coimter to the next even address in a data segment. 

■EXIT MASM 

.EXIT [return_value_expi] 

Produces termination code. MASM m^ode only. Synonymous with EXITCODE. 

EXITCODE Ideal, MASM 

EXITCODE [return_value_expi] 

Produces termination code. You can use it for each desired exit point. 
retum_value_expr is a number to be returned to the operating system. If you 
don't specify return_value_expr, the value in AX is returned. 
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EXITM Ideal, MASM 

EXITM 

Terminates macro- or block-repeat expansion and returns control to the next 
statement following the macro or repeat-block call. 

EXTERN MASM 

EXTREN definition [,definition]... 

Synon5nnous with EXTRN. MASM mode only. 

EXTERNDEF masm 

EXTERNDEF [language] name\type [,[language] name:type]... 

This directive defines one or more external variables, labels, or symbols called 
name, of type type, name is treated as PUBLIC if it is defined in the current 
module; it is treated as EXTERN if it is referenced in the module, name is 
ignored if it is not referenced in the module. If type is ABS, name can be 
imported as a constant. This directive is normally used in include files. 

EXTRN __^ Ideal, MASM 

EXTRN definition Idefinition]... 

Indicates that a symbol is defined in another module, definition describes a 
symbol and has the following format: 

[language] nam€{count1]:type [■.count2] 

language specifies that the naming conventions of C, PASCAL, BASIC, 
FORTRAN, ASSEMBLER, or PROLOG are to be applied to symbol name, 
name is the sym^bol that is defined in another module and can optionally be 
followed by countl, an array element multiplier that defaults to 1. type must 
match the type of the symbol where it's defined and must be one of the 
following: NEAR, FAR, PROC, BYTE, WORD, DWORD, DATAPTR, 
CODEPTR, FWORD, PWORD, QWORD, TBYTE, ABS, or a shuchire name. 
countl specifies how many items this external symbol defines and defaults to 1 
if not specified. 

.FARDATA masm 

.FARDATA [segmentname] 

S5nionymous with FARDATA. MASM mode only. 

FARDATA ideal 

F^RDAT^ [segmentname] 

Defines the start of a far initialized data segment, segmentname, if present, 
overrides the default segment name. 
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■FARDATA? masm 

.FARDATA? [segmentname] 

Defines the start of a far iminitialized data segment, segmentname, if present, 
overrides the default segment name. 

FASTIMUL Ideal, MASM 

?kSl\Wl<dest_reg>,<source_r/m>,<value> 

Generates code that multiplies source register or memory address by value, and 
puts it into destination register. 

FLIPFLAG Ideal, MASM 

flagreg FLIPFLAG flagreg] 

Optimized form of XOR that complements bits with shortest possible 
instruction. Use only if the resulting contents of the flags registers are 
unimportant. 

FOR MASM 

FOR parameter, arg 1[, arg2[.. . 

statements 
ENDM 

Synonymous with IRP. MASM mode only. 

FORC MASM 

FORC parameter,string 

statements 
ENDM 

Synonymous with IRPC. MASM mode only. 

FWORD MASM 

[name] FWORD [type PTR] expression [,expression]... 

Allocates and initializes a 6 bytes (a far 48-bit pointer) of storage. Synonymous 
with DF. MASM mode only. 

GETFIELD ideal, MASM 

GEJ?\ElD<fielcl_name><clestination_reg>,<source_r/m> 

Generates code that retrieves the value of a field found in the same source 
register or memory address, and sets the destination to that value. 
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GLOBAL ^ Ideal, MASM 

GLOBAL definition [,definition]... 

Acts as a combination of the EXTRN and PUBLIC directives to define a global 
symbol, definition describes the s5nnbol and has the following format (boldface 
items are literal): 

[language] name [[ counti ]] :type [:count2\ 

language specifies that the naming conventions of C, PASCAL, BASIC, 
FORTRAN, NOLANGUAGE, or PROLOG are to be applied to symbol name. 
If name is defined in the current source file, it is made public exactly as if used in 
a PUBLIC directive. If not, it is declared as an external symbol of type type, as if 
the EXTRN directive had been used, name can be followed by an optional array 
count multiplier, counti, which defaults to 1. type must match the type of the 
symbol in the module where it is defined and must be one of the following: 
NEAR, FAR, PROC, BYTE, WORD, DATAPTR, CODEPTR, DWORD, 
FWORD, PWORD, QWORD, TBYTE, ABS, or a sfaructure name, counti 
specifies how many items this symbol defines (1 is the default). 

GOTO Ideal. MASM 

GOTO tag_symbol 

Tells Turbo Assembler to resume execution at the specified macro tag 
{tag_symhol). GOTO terminates any conditional block that it is found in. 

GROUP ^ Ideal, MASM 

GROUP groupname segmentname [,segmentname]... 

groupname GROUP segmentname Isegmentname]... 

Associates groupname with one or more segments, so that all labels and 
variables defined in those segments have tiieir offsets computed relative to the 
beginning of group groupname. segmentname can be either a segment name 
defined previously with SEGMENT or an expression starting with SEG. In 
MASM mode, you must use a group override whenever you access a symbol in 
a segment that is part of a group. In Ideal mode. Turbo Assembler 
automatically generates group overrides for such sjmibols. 

IDEAL ideal, MASM 

IDEAL 

Enters Ideal assembly mode. Ideal mode will stay in effect until it is overridden 
by a MASM or QUIRKS directive. 

IF ideal, MASM 

IF expression 

statementsi 
[ELSE 
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statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statements! up to the 
optional ELSE directive, provided that expression is true (nonzero). If expression 
is falso (zero), statements! are assembled. 

■IF MASM 

.IF expression 

statementsi 
[.ELSE 

statements2\ 
.ENDIF 

This directive generates code that executes statementsi if the expression evaluates 
true. If an .ELSE follows the .IF, statements! are executed if the expression 
evaluates false. Because the expression is evaluated at run time, it can 
incorporate the run-time relational operators. MASM mode only. 

IF1 Ideal, MASM 

IF1 

statementsi 
[ELSE 

statements2[ 
ENDIF 

Initiates a conditional block, causing the assembly of statementsi up to the 
optional ELSE directive, provided directive, provided that multiple-pass mode 
(controlled by the /m command-line option) is enabled and that the current 
assembly pass is pass one. 

IF2 Ideal, MASM 

IF2 

statementsi 
[ELSE 

statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statementsi up to the 
optional ELSE directive, provided that multiple-pass mode (controlled by the 
/m command-line option) is enabled and the current assembly pass is pass two. 

IFB Ideal, MASM 

IFB argument 

statementsi 
[ELSE 
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statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statements! up to the 
optional ELSE directive, provided tihiat argument is blank (empty). If argument is 
is not blank, statements! are assembled. 

IFDEF Ideal, MASM 

IFDEF sym^o/ 

statementsi 
[ELSE 

statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statementsi up to the 
optional ELSE directive, provided that symbol is defined. If symbol is imdefined, 
statementsi are assembled. 

IFDIF Ideal, MASM 

\FD\F argument1,argument2 

statementsi 
[ELSE 

statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statementsi up to the 
optional ELSE directive, provided tiKat the argximents are different. If the 
argiunents are the same, statementsi are assembled. The comparison is case 
sensitive. 

IFDIFI ^ Ideal, MASM 

IFDIFI argument1,argument2 

statementsi 
[ELSE 

statements2] 
ENDIF 

Initiates a conditional block, causing the assem^bly of truestatements up to the 
optional ELSE directive, provided tihat the arguments are different. If the 
arguments are the same, statementsi are assembled. The comparison is not case 
sensitive. 

IFE Ideal, MASM 

IFE expression 
statementsi 
[ELSE 
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statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statements! up to the 
optional ELSE directive, provided that expression is false. If expression is tiue, 
statements! are assembled. 

IFIDN Ideal, MIASM 

IFIDN argumenti ,argument2 

statementsi 
[ELSE 

statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statementsi up to the 
optional ELSE directive, provided that the arguments are identical. If the 
arguments are not identical, statementsi are assembled. The conxparison is case 
sensitive. 

IFIDNI Ideal, MASM 

IFIDNI argumenti, argument2 

statementsi 
[ELSE 

statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statementsi up to the 
optional ELSE directive, provided tiiat the arguments are identical. If the 
arguments are not identical, statementsi are assembled. The comparison is not 
case sensitive. 

IFNB Ideal, MASM 

IFNB argument 

statementsi 
[ELSE 

statements2\ 
ENDIF 

Irutiates a conditional block, causing the assembly of statementsi up to the 
optional ELSE directive, provided that argument is nonblank. If argument is 
blank, statementsi are assembled. 

IFNDEF ___^ Ideal, MASM 

IFNDEF symdo/ 
statementsi 
[ELSE 
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statements2\ 
ENDIF 

Initiates a conditional block, causing the assembly of statementsl up to the 
optional ELSE directive, provided that symbol is not defined. If symbol is not 
defined, statementsl are assembled. 

%iNCL ^ Ideal. MASM 

%INCL 

Enables listing of include files. This is the default INCLUDE file listing mode. 

INCLUDE MASM, Ideal 

INCLUDE filename or INCLUDE "filename" 

Includes source code from Hie filename at the current position in the module 
being assembled. If no extension is specified, .ASM is assumed. 

INCLUDELIB masm. ideal 

INCLUDELIB filename or INCLUDELIB "filename" 

Causes the linker to include library filename at link time. If no extension is 
specified, .LIB is assumed. 

INSTR _^^ Ideal, MASM 

name INSTR [stan,]string1 ,string2 

name is assigned the position of the first instance of string! in stringl. Searching 
begins at position start (position one if start not specified). If string! does not 
appear anjrivhere within stringl, name is set to zero. 

IRP Ideal, MASM 

IRP parameter, arg1[,arg2\... 

statements 
ENDM 

Repeats a block of statements with string substitution, statements are assembled 
once for each argument present. The arguments m.ay be any text, such as 
symbols, strings, numbers, and so on. Each time the block is assembled, the next 
argument in the list is substituted for any instance of parameter in the statements. 
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IRPC Ideal, MASM 

IRPC parameter,sthng 

statements 
ENDM 

Repeats a block of statements with character substitution, statements are 
assembled once for each character in string. Each tim.e the block is assembled, 
the next character in the string is substituted for any instances of parameter in 
statements. 

JMP Ideal, MASM 

MP<instancej)tr>MEJHOD{<object_name>-] 
<method_name>{\iSES{segreg-]offsreg} 

Functions exactly like CALL.. METHOD except that it generates a JMP instead 
of a CALL and it cleans up the stack if there are LOCAL or USES variables on 
the stack. Use primarily for tail recursion. 

JUMPS Ideal, MASM 

JUMPS 

Causes Turbo Assembler to look at the destination address of a conditional 
jump instruction, and if it is too far away to reach with the short displacement 
that these instructions use, it generates a conditional jump of the opposite sense 
around an ordinary jump instruction to the desired target address. This 
directive has the same effect as using the /JJUMPS command-line option. 

LABEL MASM, Ideal 

name LABEL type 

LABEL name type 

Defines a s5nnbol name to be of type type, name must not have been defined 
previously in the source file, type must be one of the following: NEAR, FAR, 
PROC, BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, or a structure name. 

■LALL MASM 

lALL 

Enables listing of macro expansions. 

LARGESTACK ideal, masm 

LARGESTACK 

Indicates that the stack is 32-bit. 
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■LFCOND MASM 

IFCOND 

Shows all statements in conditional blocks in the listing. 

%LINUM Ideal, MASM 

%LINUM s/ze 

Sets the width of the line-number field in listing file to size columns. The default 
is four columns. 

%LIST Ideal, MASM 

%LIST 

Shows source lines in the listing. This is the default listing mode. 

■LIST MASM 

.LIST 

Synonymous with %LIST. MASM mode only. 

■LISTALL MASM 

.LISTALL 

Begins the listing of all statements. Combines the directives .LIST, XISTIF, and 
XISTMACROALL. 

■LISTIF MASM 

.LISTIF 

Lists all statements in conditional blocks, whether true or false. Synonymous 
with .LFCOND. MASM mode only. 

■LISTMACRO MASM 

.LISTMACRO 

Enables the listing of macro expansions that generate code or data. 
Synonymous with .XALL. MASM mode only. 

■LISTMACROALL masm 

.LISTMACROALL 

Enables the listing of macro all macro expansions. Synonymous with .LALL. 
MASM mode only. 
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LOCAL Ideal, MASM 

In macros: 

LOCAL symbol [,symbol\... 
In procedures: 

LOCAL element lelemenfi... [=symbol\ 

Defines local variables for macros and procedures. Within a macro definition, 
LOCAL defines temporary symbol names that are replaced by new unique 
symbol names each time the macro is expanded. LOCAL must appear before 
any other statements in the macro definition. 

Within a procedure, LOCAL defines names that access stack locations as 
negative offsets relative to the BP register. If you end the argument list with an 
equal sign (=) and a symbol, that symbol will be equated to the total size of the 
local sjnnbol block in bytes. Each element has the following syntax (boldface 
brackets are literal): 

symname [[counti]] [:[debug_size] [.type] [:count2\] 

type is the data type of the argument. It can be one of the following: BYTE, 
WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, QWORD, 
TBYTE, NEAR, FAR, PROC, or a structure name. If you don't specify a type, 
WORD size is assvimed. 

count! specifies how many items of type the symbol defines. The default for 
counti is 1 if it is not specified. 

counti is an array element size multiplier. The total space allocated for the 
symbol is counti times the length specified by the type field times counti. The 
default for counti is 1 if it is not specified. 

The optional dehug_size has this syntax: 

[type] PTR 

LOCALS Ideal, MASM 

LOCALS {prefix] 

Enables local symbols, whose names will begin with two at-signs (@@) or the 
two-character prefix if it is specified. Local sjmibols are automatically enabled in 
Ideal mode. 

MACRO Ideal, MASM 

MACRO name [parameter Iparametef]...] 

name MACRO [parameter Iparametei]...] 

Defines a macro to be expanded later when name is encountered, parameter is a 
placeholder that you use in the the body of the macro definition wherever you 
want to substitute one of the actual arguments the macro is called with. 

%MACS Ideal, MASM 

&MACS 

Enables listing of macro expansions. 
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MASKFLAG ideal, masm 

flagsreg MASKFLAG flagsreg 

Optimized form of AND that clears bits with the shortest possible instruction. 
Use only if the resulting contents of the flags registers are unimportant. 

MASM Ideal, MASM 

MASM 

Enters MASM assembly mode. This is the default assem.bly mode for Turbo 

Assembler. 

MASM51 Ideal, MASM 

MASM51 

Enables assembly of some MASM 5.1 enhancements. 

MODEL Ideal, MASM 

MODEL [model modifiei] memorymodel [module name] 
[,[language modifief\ language ] [,model modifiei] 

Sets the memory model for sinaplified segmentation directives, model modifier 
can come before memorymodel or at the end of the statement and must be either 
NEARSTACK or FARSTACK if present, memorymodel is TINY, SMALL, 
MEDIUM, COMPACT, LARGE, HUGE or TCHUGE. module name is used in 
the large models to declare the name of the code segment, language modifier is 
WINDOWS, ODDNEAR, ODDFAR, or NORMAL and specifies generation of 
MS-Windows procedure entry and exit code, language specifies which language 
you will be calling from to access the procedures in this module: C, PASCAL, 
BASIC, FORTRAN, PROLOG, or NOLANGUAGE. Turbo Assembler 
automatically generates the appropriate procedure entry and exit code when 
you use the PROC and ENDP directives, language also tells Turbo Assembler 
which naming conventions to use for public and external symbols, and in what 
order procedure arguments were pushed onto the stack by the calling module. 
Also, tihe appropriate form of the RET instruction is generated to remove the 
arguments from the stack before returning if required. 

■MODEL MASM 

.MODEL 

Synonymous with MODEL. MASM mode orily. 

MULTERRS ideal, masm 

MULTERRS 

Allows multiple errors to be reported on a single source line. 
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NAME Ideal, MASM 

NAME modulename 

Sets the object file's module name. This directive has no effect in MASM mode; 
it only works in Ideal mode. 

%NEWPAGE Ideal, MASM 

%NEWPAGE 

Starts a new page in the listing file. 

%NOCONDS Ideal, MASM 

%NOCONDS 

Disables the placement of statements in conditional blocks in the listing file. 

%NOCREF Ideal, MASM 

%NOCREF [symbol, ... ] 

Disables cross-reference listing (CREF) information accumulation. If you 
supply one or more symbol names, cross-referencing is disabled only for those 
symbols. 

%NOCTLS Ideal, MASM 

%NOCTLS 

Disables placement of listing-control directives in the listing file. This is the 
default listing-control mode for Turbo Assembler. 

NOEMUL Ideal, MASM 

NOEMUL 

Causes all subsequent numeric coprocessor instructions to be generated as real 
instructions, instead of emulated instructions. When your program is executed, 
you must have an 80x87 coprocessor installed or these instructions will not 
work properly. This is the default floating-point assembly mode for Turbo 
Assembler. 

%NOINCL Ideal, MASM 

%NOINCL 

Disables listing of source Unes from INCLUDE files. 

NOJUMPS Ideal, MASM 

NOJUMPS 

Disables stretching of conditional jumps enabled with JUMPS. This is the 
default mode for Turbo Assembler. 
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%NOLIST Ideal, MASM 

%NOLIST 

Disables output to the listing file. 

.NOLIST MASM 

.NOLIST 

Disables output to the list file. Synonymous with .XLIST. MASM mode only. 

.NOLISTIF MASM 

.NOLISTIF 

Prevents statements in false conditional blocks from appearing in iiie listing file. 
Synonymous with .SFCOND. MASM mode only. 

■NOLISTMACRO masm 

.NOLISTMACRO 

Suppresses the listing of all statements in macro expansions . S5monyinous with 
.SALL. MASM mode only. 

NOLOCALS Ideal, MASM 

.NOLOCALS 

Disables local symbols enabled with LOCALS. This is the default for Turbo 
Assembler's MASM mode. 

%NOMACS Ideal, MASM 

%NOMACS 

Lists only macro expansions that generate code. This is the default macro listing 
mode for Turbo Assembler. 

N0MASM51 Ideal, MASM 

N0MASM51 

Disables assembly of certain MASM 5.1 enhancements enabled with MASM51. 
This is the default mode for Turbo Assembler. 

NOMULTERRS ideal, masm 

NOMULTERRS 

Allows only a single error to be reported on a source line. This is the default 
error-reporting mode for Turbo Assembler. 
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NOSMART Ideal, MASM 

NOSMART 

Disables code optimizations that generate different code than MASM. 

%NOSYMS Ideal, MASM 

%NOSYMS 

Disables placement of the symbol table in the listing file. 

%NOTRUNC Ideal, MASM 

%NOTRUNC 

Prevents truncation of fields whose contents are longer than the corresponding 
field widths in the listing file. 

NOWARN Ideal, MASM 

NOWARN [warnclass] 

Disables warning messages with warning identifier warnclass, or all warning 
messages if warnclass is not specified. 

OPTION MASM 

OPTION option 

TASM supports the following MASM options: CASEMAP, DOTNAME, 
EMULATOR, EXPR16, EXPR32, LJMP, NOEMULATOR, NOKEYWORD, 
NOLJMP, NODOTNAME, NOSCOPED, PROC, SEGMENT, and SCOPED. 

Note that all other MASM options are recognized, but are ignored, by TASM. 

ORG ^ Ideal, MASM 

ORG expression 

Sets the location counter in the current segment to the address specified by 

expression. 

%OUT MASM 

%OUT text 

Displays text on screen. 

P186 Ideal, MASM 

P186 

Enables assembly of 80186 processor instructions. 



Chapter 3, Directives 45 



P286 Ideal, MASM 

P286 

Enables assembly of all 80286 (including protected mode) processor 
instructions and 80287 numeric coprocessor instructions. 

P286N Ideal, MASM 

P286N 

Enables assembly of non-privileged (real mode) 80286 processor instructions 
and 80287 numeric coprocessor instructions. 

P286P Ideal, MASM 

P286P 

Enables assembly of all 80286 (including protected mode) processor 
instructions and 80287 numeric coprocessor instructions. 

P287 Ideal, MASM 

P287 

Enables assembly of 80287 numeric coprocessor instructions. 

P386 Ideal, MASM 

P386 

Enables assembly of all 80386 (including protected mode) processor 
instructions and 80387 numeric coprocessor instructions. 

P386N ^ Ideal, MASM 

P386N 

Enables assembly of non-privileged (real mode) 80386 processor instructions 
and 80387 numeric coprocessor instructions. 

P386P , Ideal, MASM 

P386P 

Enables assembly of all 80386 (including protected mode) processor 
instructions and 80387 numeric coprocessor instructions. 

P387 Ideal, MASM 

P387 

Enables assembly of 80387 numeric coprocessor instructions. 
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%PAGESIZE 



lde^,f 



%PAGESIZE [rows] [,cols] , 

Sets the listing page height and width, starts new pages, rows specifies tl 
number of lines that will appear on each listing page (10. .255). cols specij 
number of columns wide tiie page will be (59..255). Omitting rows or cols 
the current setting unchanged. If you follow %PAGESIZE with a plus s|| 
a new page starts, the section number is incremented, and the page nun' 
restarts at 1. %PAGESIZE with no arguments forces the listing to resuir 
new page, with no change in section number. 

%PCNT id^ 

%PCNT width 

Sets segment:offset field width in listing file to width columns. The defai 
for 16-bit segments and 8 for 32-bit segments. 

PN087 ide 

PN087 

Prevents the assembling of numeric coprocessor instructions (real or eri 

%POPLCTL wi 

%POPLCTL 

Resets the listing controls to the way they were when the last %PUSH1 
directive was issued. 

POPSTATE ^ 

POPSTATE 

Returns to last saved state from Turbo Assembler's internal state stack 

PROC 1^(1 

PROC name [language modifiei] [language] [distance] 
[USES items,] [argument [,argument]...] 
[REJURHS argument [,argumen^...] 

statements 
name ENDP 

name PROC [language modifiei] [language] [distance] 
[USES Items,] [argument [,argumen{]...] 
[RETURNS argument largumenf]...] 

statements 
name END? 

Defines the start of procedure name, language modifier is either WIND( 
NOWINDOWS, to specify generation of MS-Windows entry/exit co^ 
language specifies which language you will be calling from to access til 
procedure: C, PASCAL, BASIC, FORTRAN, NOLANGUAGE, or PI 
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This determines symbol naming conventions, the order of any arguments on 
the stack, and whether the argiraients will be left on the stack when the 
procedure returns, distance is NEAR or FAR and deternunes the type of RET 
instruction that wiU be assembled at the end of the procedure, items is a list of 
registers and /or single-token data items to be pushed on entry and popped on 
exit from the procedure, argument describes an argument the procedure is 
called with. Each argument has the following syntax: 

argnam^[count1]] [[.distance] [PTR] type] [xount2] 

argname is the name you'll use to refer to this argimient throughout the 
procedure, distance is NEAR or FAR to indicate Siat the argument is a pointer of 
the indicated size, type is the data type of the argument and can be BYTE, 
WORD, DWORD, FWORD, PWORD, QWORD, TBYTE, or a structure name. 
WORD is assumed if none is specified, countl and count! are the number of 
elements of type. PTR tells Turbo Assembler to emit debug information to let 
Turbo Debugger know that the argum^ent is a pointer to a data item. Using PTR 
without distance causes the pointer size to be based on the current memory 
model and segment address size. RETURNS introduces one or more 
arguments that won't be popped from the stack when the procedure returns. 

PROCDESC Ideal, MASM 

PROCDESC name [language] [language modifiei] [distance] [arguments] 

name PRODESC [[language_modifiei\ language] [distance] [arguments] 

Declares a procedure prototype, which lets Turbo Assembler check the types 
and number of parameters to procedure calls and declarations, and specifies 
language and distance. Also serves to PUBLIC or EXTRN the procedure name. 

PROCTYPE Ideal. MASM 

PROCTYPE name [procedure_description] 
name PROCTYPE [procedure_descrlption] 
procedurejiescription has the following syntax: 

[[language_modifiei]language][distance][argumentJis{] 
argument Jist has the following syntax: 

argumen^argumenf^... 
where each argument has the following syntax: 

[argname'^count1_expressions]\:complexJyp^:count2_expression] 

Declares a procedure type. Describes a procedure but does not create a 
prototype for it. Can be used in place of the language specifier in a call to allow 
argument type checking during compilation. 

PROTO MASM 

name PROTO ^ianguagejmodifier] language] [distance] [argumenfs] 

Prototypes the function name. Synonymous with PROCDESC. MASM mode 
only. 
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PUBLIC Ideal, MASM 

PUBLIC [language] symbol [,[language] symbol]... 

Declares symbol to be accessible from other modules. If language is specified 
(Q PASCAL, BASIC FORTRAN, ASSEMBLER, or PROLOG), symbol is 

made public after having the naming conventions of the specified language 
applied to it. 

PUBLICDLL Ideal, MASM 

PUBLICDLL [language] symbol [,[language] symbol]... 

Declares symbols to be accessible as dynamic link entry points from other 
modules, symbol (a PROC or program label, data variable name, or numeric 
constant defined with EQU) becomes accessible to other programs vinder 
Windows. If language is specified (C, PASCAL, BASIC, FORTRAN, PROLOG, 
or NOLANGUAGE), symbol is made public after having the naming 
conventions of the specified language applied to it. 

PURGE Ideal, MASM 

PURGE macroname [,macroname]... 
Removes macro definition macroname. 

%PUSHLCTL Ideal, MASM 

%PUSHLCTL 

Saves current listing controls on a 16-level stack. 

PUSHSTATE Ideal, MASM 

PUSHSTATE 

Saves current operating state on an internal stack that is 16 levels deep. 

QUIRKS Ideal, MASM 

QUIRKS 

Allows you to assemble a source file that makes use of one of the true MASM 
bugs. 

QWORD MASM 

[name] QWORD expression [,expression]... 

Allocates and initializes 8 bytes (a quadword) of storage. Synon5nnous with 
DQ. MASM mode only. 

■RADIX MASM 

.RADIX radix 

Synonymous with RADIX. MASM mode only. 
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RADIX Ideal, MIASM 

RADIX radix 

Sets the default radix for integer constants in expressions to 2, 8, 10, or 16. 

REAL4 MASM 

REAL4 

Allocates a short (32 bit) real number. MASM mode only. 

REALS MASM 

REALS 

Allocates a long (64 bit) real number. MASM mode only. 

REAL10 MASM 

REAL10 

Allocates a 10-byte (80 bit) real or BCD number. MASM mode only. 

RECORD MASM, Ideal 

nameRECORD field [,fielcl\... 

RECORD name field [,field\... 

Defines record name that contains bit fields. Each, field describes a group of bits 
in the record and has the following format (boldface items are literal): 

fieldname:widtli=expression] 

fieldname is the name of a field in the record, width (1..16) specifies the number of 
bits in the field. If the total number of bits in all fields is 8 or less, the record will 
occupy 1 byte; 9..16 bits will occupy 2 bytes; otherwise, it will occupy 4 bytes. 
expression provides a default value for the field. 

REPEAT MASM 

REPEAT expression 

statements 
ENDM 

Synonymous with REPT. MASM mode only. 
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.REPEAT MASM 

.REPEAT 

statements 
.UNTIL expression 

.REPEAT 

statements 
.UNTILCXZ [expression] 

This directive generates code that repeats the execution of the block of 
statements irntil the expression evaluates true. The directive .UNTILCXZ, which 
evaluates true when the register CX is zero, can be used with or without the 
conditional expression. Because the expression is evaluated at run time, it can 
incorporate the run-time relational operators. MASM mode only. 

REPT Ideal, MASM 

REPT expression 

statements 
ENDM 

Repeats the statement block until expression evluates true. 

RETCODE Ideal, MASM 

RETCODE 

Generates either a near return (2-byte displacement) or a far return (4-byte 
displacement) depending on the size of the memory model declared in the 
.MODULE directive. A tiny, small, or compact memory model results in a near 
return, while a medium, large, or huge memory model results in a far return. 
See the RET processor instruction in Chapter 4 for more information. 

RETF Ideal, MASM 

RETF 

Generates a far return (4-byte displacement) from a procedure. See the RET 
processor instruction in Chapter 4 for more information. 

RETN Ideal. MASM 

RETN 

Generates a near return (2-byte displacement) from a procedure. See the RET 
processor instruction in Chapter 4 for more information. 

■SALL MASM 

.SALL 

Suppresses the listing of all statements in macro expansions. MASM mode only. 
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SBYTE MASM 

[name] SBYTE expression [,expression]... 

Allocates and initializes a signed byte of storage, name is the symbol you'll 
subsequently use to refer to the data, expression can be a constant expression, a 
question mark, a character string, or a DUPlicated expression. 

SDWORD MASM 

[name] SDWORD expression [,expression]... 

Allocates and initializes a signed doubleword (4 bytes) of storage, name is the 
symbol you'll subsequently use to refer to the data, expression can be a constant 
expression, a question mark, a character string, or a DUPlicated expression. 

SEGMENT MASM, ideal 

SEGMENT name [align] [combine] [use] [class'] 

name SEGMENT [align] [combine] [use] [class'] 

Defines segment name with fuU attribute control. If you have already defined a 
segment with the same name, this segment is treated as a continuation of the 
previous one. align specifies the type of memory boundary where the segment 
must start: BYTE, WORD, DWORD, PARA (default), or PAGE, combine 
specifies how segments from different modules but with the same name will be 
combined at link time: AT expression (locates segment at absolute paragraph 
address expression), COMMON (locates this segment and all other segments 
with the same name at the same address), MEMORY (concatenates aU 
segments with the same name to form a single contiguous segm.ent), PRIVATE 
(does not combine this segment with any otiier segments; this is the default 
used if none specified), PUBLIC (same as MEMORY above), STACK 
(concatenates all segmentis with the same name to form a single contiguous 
segment, then initializes SS to the beginning of the segment and SP to the length 
of the segment) or VIRTUAL (defines a special kind of segment that will be 
tieated as a common area and attached to another segment at link time), use 
specifies the default word size for the segment if 386 code generation is enabled, 
and can be either USE16 or USE32. class contiols the ordering of segments at 
link time: segments with the same class name are loaded into memory together, 
regardless of the order in which they appear in the source file. 

■SEQ MASM 

.SEQ 

Sets sequential segment-ordering. This is the default ordering mode for Turbo 
Assembler. .SEQ has the same function as the /s command-lme option. 

SETFIELD Ideal, MASM 

SElf\ElD<field_name><destination_r/m>,<source_reg> 

Generates code that sets a value in a record field. Sets the field in the destination 
register or memory address with the contents of a source register. 
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SETFLAG Ideal, MASM 

flagreg SETFLAG flagreg 

Optimized form of OR that sets bits with shortest possible instruction. Use only 
if the resulting contents of the flags register is imimportant. 

.SFCOND MASM 

.SFCOND 

Prevents statements in false conditional blocks from appearing in the listing file. 

SIZESTR Ideal, MASM 

name SIZESTR string 

Assigns the number of characters in string to name. A null string has a length of 



SMALLSTACK ideal, masm 

SMALLSTACK 

Indicates that the stack is 16-bit. 

SMART Ideal, MASM 

SMART 

Enables all code optimizations. 

■STACK MASM 

.STACK [size] 

Synonymous with STACK. MASM mode only. 

STACK Ideal, MASM 

STACK [size] 

Defines the start of the stack segment, allocating size bytes. 1024 bytes are 
allocated if size is not specified. 

.STARTUP MASM 

.STARTUP 

Provides initialization code. MASM mode only. Equivalent to 
STARTUPGODE. MASM mode only. 

STARTUPCODE ideal, masm 

STARTUPCODE 

Provides initialization code and marks the beginning of the program. 
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STRUC Ideal, MASM 

[name] SJR[iC{<modifiers>}{<parent_name>}{METHOD<method_list>} 

<structure_data> 
ENDS [name] 

STRUC [name]{<modifiers>}{<parent_name>]{MEJ[\OD<methodJist>] 

<structure_data> 
ENDS [name] 

parent_name is the name of the parent object's data structure, meihodjist is like 
that of TABLE. structure_data is any (additional) data present in an instance of 
the object, modifiers can be GLOBAL, NEAR, or FAR. 

STRUCT MASM 

[name] ST WCJ{<modifiers>}{<parent_name>}{UEJHOD<method_list>} 

<structure_data> 
ENDS [name] 

SJRUCl [name]{<modifiers>}{<parent_name>]{UEJHOD<metiiodJist>} 

<structure_data> 
ENDS [name] 

Synonymous with STRUC. MASM mode only. 

SUBSTR Ideal, MASM51 

name SUBSTR string,position[,size] 

Defines a new string name consisting of characters from string starting at 
position, with a length of size. All the remaining characters in string, starting 
from position, are assigned to name if size is not specified. 

SUBTITLE MASM 

SUBTITLE text 

Sets the subtitle in the listing file to text. Synonymous with %SUBTTL and 
.SECOND. MASM mode only. 

SUBTTL MASM 

SUBTTL "text' 

Synonymous with %SUBTTL. MASM mode only. 

%SUBTTL ideal, MASM 

%SUBTTL "text' 

Sets subtitle in listing file to text. 
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SWORD _^__ MASM 

[name] SWORD expression [,expression]... 

Allocates and initializes a signed word (2 bytes) of storage, name is the symbol 
you'll subsequently use to refer to the data, expression can be a constant 
expression, a question mark, a character string, or a DUPlicated expression. 

%SYMS Ideal, MASM 

%SYMS 

Enables symbol table placement in listing file. This is the default symbol listing 
mode for Turbo Assembler. 

TABLE Ideal. MASM 

l/KBlEname[table_member[,table_member...]] 

Constructs a table structure used to contain method pointers for objects. 

%TABSIZE Ideal, MASM 

%TABSIZE M//c/f/7 

Sets the number of colimins between tabs in the listing file to width. The default 
is 8 columns. 

TBLINIT Ideal, MASM 

TBLINIT 

Initializes pointer in an object to the virtual method table. 

TBLINST Ideal, MASM 

TBLINST 

Creates an instance of the virtual table for the current object and defines 
@TahleAddr_<object>. Must be used after every object definition that includes 
virtual methods, so that the virtual table is allocated. You should use this 
directive in only one module of your program. 

TBLPTR Ideal, MASM 

TBLPTR 

Places a virtual table pointer within the object data. Defines a structure member 
of the name @Mptr_<ofc/ecf>. This can only be used inside an object definition. 

TBYTE __^ MASM 

[name] TBYTE expression [,expression]... 

Allocates and initializes 10 bytes of storage. S5nionymous with DT. 
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TESTFLAG 



Ideal, MASM 



f/afifreg TESTFLAG flagreg 

Optimized form of TEST that tests bits with the shortest possible instruction. 



%TEXT 



Ideal, MASM 



%TEXT width 

Sets width of source field ii\ listing file to width columns. 



TEXTEQU 



MASM 



name TEXTEQU [/fem] 

Assigns item to name. The item can be either a literal string, a string returned by 
a macro function, or a string constant (must be preceded by a %). 



.TFCOND 



TITLE 



MASM 



TFCOND 

Toggles conditional block-listing mode. MASM mode only. 



MASM 



TITLE "text 

Synonymous with %TITLE. MASM mode only. 

%TITLE 



Ideal, MASM 



%TITLE"texr 

Sets title in listing file to text. 

%TRUNC 



ideal, MASM 



%TRUNC 

Truncates listing fields that are too long. 

TYPEDEF 



Ideal, MASM 



TYPEDEF type_name complexjype 
type_name TYPEDEF complexjype 
Defines named types. 

UDATASEG 



Ideal, MASM 



UDATASEG 

Defines the start of an uninitialized data segment. 
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UFARDATA ideal, masm 

UFARDATA 

Defines the start of an uninitialized far data segment. 

UNION Ideal, MASM (disabled by QUIRKS) 

UNION name 

fields 
ENDS [name] 

name UNION 

fields 
[name] ENDS 

Defines a tinion called name. A union is just like a STRUC except that all its 
members have an offset of zero from the start of the union. This results in a set 
of fields that are overlay ed, allowing you to refer to the memory area defined 
by the union with different names and different data sizes. The length of a 
union is the length of its largest member, not the sum of the lengths of its 
members as in a STRUC. fields define the fields that comprise the union. Each 
field uses the normal data allocation directives (DB, DW, and so on) to define 
its size. 

■UNTIL _^ MASM 

.REPEAT 

statements 
.UNTIL expression 

Termination directive to a .REPEAT loop. When expression evaluates true, the 
loop started with the .REPEAT directive terminates. 

■UNTILCXZ MASM 

.REPEAT 

statements 
.UNTILCXZ [express/on] 

Termination directive to a .REPEAT loop. The directive .UNTILCXZ, which 
evaluates true when the register CX is zero, can be used with or without the 
conditional expression. 

USES Ideal, MASM 

[iSES item [Jtem]... 

Indicates which registers or single-token data items you want to have pushed at 
the beginning of the enclosing procedure and which ones you want popped just 
before the procedure returns. You must use this directive before the first 
instruction that actually generates code in your procedure. 
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VERSION MASM, Ideal 

VERSION <versionJD> 

Places Turbo Assembler in the equivalent operating mode for the specified 
version. 

WARN Ideal, MASM 

WARN [warnclass] 

Enables the type of warning message specified with warnclass, or all warnings if 
warnclass is not specified, warnclass may be one of: ALN, ASS, BRK, ICG, LCO, 
OPI, OPP, OPS, OVF, PDC, PRO, PQK, RES, or TPI. 

WHILE Ideal, MASM 

WHILE while_expression 

macro body 
ENDM 

Repeats a macro body until while_expression evaluates to (false). 

■WHILE MASM 

.WHILE expression 

statements 
.ENDW 

This directive generates code that executes the block of statements while the 
expression evaluates true. Because the expression is evaluated at run time, it can 
incorporate the run-time relational operators. MASM mode only. 

WORD MASM 

[name] WORD [type PRT] expression [,expression]... 

Allocates and initializes 2 bytes (a word) of storage. Synonymous with DW. 

.XALL MASM 

.XALL 

Causes only macro expansions that generate code or data to be listed. 

■XCREF MASM 

.XCREF 

Disables cross-reference listing (CREF) information accuniulation. 

.XLIST MASM 

.XLIST 

Disables subsequent output to listing file. MASM mode only. 
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Processor instructions 



This chapter presents instructions for the 80x86 processor set in alphabetical 
order. For each instruction, the forms are given for each operand combination, 
including object code produced, operands required, execution time, and a 
description. For each instruction, there is an operational description and a 
summary of exceptions generated. 

Operand-size and address-size attributes 

When executing instructions in a 16-bit application, 80x86 processors address 
memory using either 16- or 32-bit addresses. Consequently, each instruction 
that uses memory addresses has associated with it an address-size attribute of 
either 16 or 32 bits. Sixteen-bit addresses imply both the use of a 16-bit 
displacement in the instruction and the generation of a 16-bit address offset 
(segment relative address) as the result of the effective address calculation. 
Thirty-two-bit addresses imply the use of a 32-bit displacement and the 
generation of a 32-bit address offset. Similarly, an instruction that accesses 
words (16 bits) or doublewords (32 bits) has an operand-size attribute of either 
16 or 32 bits. 

The attributes are determined by a combination of defaults, instruction prefixes, 
and (for programs executing in protected mode) size-specification bits in 
segment descriptors. 

Default segment attribute 

For programs executed in protected mode, the D-bit in executable-segment 
descriptors determines the default attribute for both address size and operand 
size, these default attributes apply to the execution of all instructions in the 
segment. A value of zero in the D-bit sets the default address size and operand 
size to 16 bits; a value of one, to 32 bits. 

Programs that execute in real mode or virtual-8086 mode have 16-bit addresses 
and operands by default. 
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Operand-size and address-size instruction prefixes 

The internal encoding of an instruction can include two byte-long prefixes: the 
address-size prefix, 67H, and the operand-size prefix, 66H. (A later section, 
"Instiuction format," shows the position of the prefixes in an instruction's 
encoding.) These prefixes override the default segment attributes for the 
instiuction that follows. Table 4.1 shows the effect of each possible combination 
of defaults and overrides. 

Table 4.1 Effective size attributes 



Segment default D= ... 














1 


1 


1 


1 


Operand-size prefix 66h 


N 


N 


Y 


Y 


N 


N 


Y 


Y 


Address-size prefix 67h 


N 


Y 


N 


Y 


N 


Y 


N 


Y 


Effective operand size 


16 


16 


32 


32 


32 


32 


16 


16 


Effective address size 


16 


32 


16 


32 


32 


16 


32 


16 



Y = Yes, this instruction prefix is present. 
N = No, this instruction prefix is not present. 



Address-size attribute for stacic 



Instiuctions that use the stack implicitly (for example, POP EAX) also have a 
stack address-size attribute of either 16 or 32 bits, histiuctions with a stack 
address-size attribute of 16 use the 16-bit SP stack pointer register; instructions 
with a stack address-size attribute of 32 bits use the 32-bit ESP register to form 
the address of the top of the stack, 

The stack address-size attiibute is contioUed by the B-bit of the data-segment 
descriptor in the SS register. A value of zero in the B-bit selects a stack address- 
size attribute of 16; a value of one selects a stack address-size attiibute of 32. 



Instruction format 



All instruction encodings are subsets of the general instiuction format shown in 
Figure 4.1. Instructions consist of optional instiuction prefixes, one or two 
primary opcode bytes, possibly an address specifier consisting of the ModR/M 
byte and the SIB (scale index base) byte, a displacement, if required, and an 
immediate data field, if required. 

Smaller encoding fields can be defined within the primary opcode or opcodes. 
These fields define the direction of the operation, ti\e size of the displacements, 
the register encoding, or sign extension; encoding fields vary depending on the 
class of operation. 

Most instructions that can refer to a operand in memory have an addressing 
form byte following the primary opcode byte(s). This byte, called the ModR/M 
byte, specifies the address form to be used. Certain encodings of the ModR/M 
byte indicate a second addressing byte, the SIB byte, which follows the ModR/ 
M byte and is required to fully specify the addressing form. 
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Figure 4.1 80386 instruction format 



Instruction 
prefix 


Address- 
size prefix 


Operand- 
size prefix 


Segment 
override 


or 1 


or 1 or 1 


or 1 


Number of bytes 



Opcode Modr/M SIB Displacement Immediate 



1 or 2 or 1 or 1 0, 1, 2, or 4 0, 1, 2, or 4 

Number of bytes 



Addressing forms can include a displacement immediately following either the 
ModR/M or SIB byte. If a displacement is present, it can be 8, 16, or 32 bits. 

If the instruction specifies an immediate operand, the immediate operand 
always follows any displacement bytes. The immediate operand, if specified, is 
always the last field of the instruction. 

The following are the allowable instruction prefix codes: 

• F3h: REP prefix (used only with string instructions) 

• F3h: REPE/REPZ prefix (used only with string instructions) 

• F2h: REPNE/REPNZ prefix (used only with string instructions) 

• FOh: LOCK prefix 

The following are the segment override prefixes: 

• 2Eh: CS segment override prefix 

• 36h: SS segment override prefix 

• 3Eh: DS segment override prefix 

• 26h: ES segment override prefix 

• 64h: FS segment override prefix (386 processors and greater) 

• 65h: GS segment override prefix (386 processors and greater) 

• 66h: Operand-size override 

• 67h: Address-size operand 

ModR/M and SIB bytes 

The ModR/M and SIB bytes follow the opcode byte(s) in many of the 80x86 
instructions. They contain the following information: the indexing type or 
register number to be used in the instruction; the register to be used, or more 
information to select the instruction; and the base, index, and scale information. 

The ModR/M byte contains three fields of information: 

• The mod field, which occupies the two most significant bits of the byte, 
combines with the r/m. field to form 32 possible values: 8 registers and 24 
indexing modes. 

• The reg field, which occupies the next three bits following the mod field, 
specifies either a register number or three more bits of opcode information. 
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The meaning of the reg field is determined by the first (opcode) byte of the 
instruction. 

• The r/m field, which occupies the three least-significant bits of the byte, can 
specify a register as the location of an operand, or can form part of tike 
addressing-mode encoding in combination with the mod field as described 
earlier. 

• The based indexed and scaled indexed forms of 32-bit addressing require 
the SIB b)^e. The presence of the SIB byte is indicated by certain encodings of 
the ModR/M byte. The SIB byte then includes the following fields: 

* The ss field, which occupies the 2 most-significant bits of the byte, 
specifies the scale factor. 

* The index field, which occupies the next 3 bits following the ss field 
specifies the register number of the index register. 

* The base field, which occupies the 3 least-significant bits of the byte, 
specifies the register ntimber of the base register. 

Figure 4.2 shows the format of the ModR/M and SIB bytes. 

Figure 4.2 ModR/M and SIB byte formats 



7 6 


Modr/M Byte 
5 4 3 2 1 


Mod 


Reg/Opcode 


R/M 


SIB (Scale Index Base) Byte 
7 6, 5 4 3 2 1 


SS 


Index 


Base 



The values and corresponding addressing forms of the ModR/M and SIB bytes 
are shown in Tables 4.2, 4.3, and 4.4. 



Table 4.2 1 6-bit addressing forms with ModR/M byte 












r8(/r) 


AL 


CL 


DL 


BL 


AH 


CH 


DH 


BH 






rl6(/r) 


AX 


CX 


DX 


BX 


SP 


BP 


SI 


DI 






r32(/r) 


EAX 


ECX 


EDX 


EBX 


ESP 


EBP 


ESI 


EDI 






/digit (opcode) 





1 


2 


3 


4 


5 


6 


7 






REG = 


000 


001 


010 


Oil 


100 


101 


110 


111 






Effective address 


ModR/M 

uuo 


Modl^M values in hexadecimal 

on (js 10 l.s 20 23 






[BX + SI I 


30 


38 


[BX + DI] 




001 


01 


09 


11 


19 


21 


29 


31 


39 


[BP + SI] • 




010 


02 


OA 


12 


lA 


22 


2A 


32 


3A 


[BP + DI] 


00 


on 


03 


OB 


13 


IB 


23 


2B 


33 


3B 


[SI] 




100 


04 


OC 


14 


IC 


24 


2C 


34 


3C 


[DI] 




101 


05 


OD 


15 


ID 


25 


2D 


35 


3D 


displ6 




no 


06 


OE 


16 


IE 


26 


2E 


36 


3E 


[BX] 




111 


07 


OF 


17 


IF 


27 


2F 


37 


3F 


[BX + SI] + disp8 




000 


40 


48 


50 


58 


60 


68 


70 


78 


[BX + DI] + disp8 




001 


41 


49 


51 


59 


61 


69 


71 


79 


[BP + SI] + dispS 




010 


42 


4A 


52 


5A 


62 


6A 


72 


7A 


[BP + DI] + dispS 


01 


on 


43 


4B 


53 


5B 


63 


6B 


73 


7B 


[SI] + disp8 




100 


44 


4C 


54 


5C 


64 


6C 


74 


7C 


[DI] + dispS 




101 


45 


4D 


55 


5D 


65 


6D 


75 


7D 
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Table 4.2 1 6-bit addressing forms with 

Effective address ModR/M 



i\/lodR/M byte (continued) 

ModR/M values in hexadecimal 



[BP] + disp8 


110 


46 


4E 


56 


5E 


66 


6E 


76 


7E 


[BX] + disp8 


111 


47 


4F 


57 


5F 


67 


6F 


T7 


7F 


[BX + SI] + displ6 


000 


80 


88 


90 


98 


AO 


AS 


BO 


B8 


[BX + DI] + displ6 


001 


81 


89 


91 


99 


Al 


A9 


Bl 


B9 


[BP + SI] + displ6 


010 


82 


8A 


92 


9A 


A2 


AA 


B2 


BA 


[BP + DI] + displ6 


10 Oil 


83 


8B 


93 


9B 


A3 


AB 


B3 


BB 


[SI] + displ6 


100 


84 


8C 


94 


9C 


A4 


AC 


B4 


BC 


[DI] + displ6 


101 


85 


8D 


95 


9D 


A5 


AD 


B5 


BD 


[BP] + displ6 


110 


86 


8E 


96 


9E 


A6 


AE 


B6 


BE 


[BX] + displ6 


111 


87 


8F 


97 


9F 


A7 


AF 


B7 


BF 


EAX/AX/AL (386) 


000 


CO 


C8 


DO 


D8 


EO 


E8 


FO 


F8 


ECX/CX/CL (386) 


001 


CI 


C9 


Dl 


09 


El 


E9 


Fl 


F9 


EDX/DX/DL(386) 


010 


C2 


CA 


D2 


DA 


E2 


EA 


F2 


FA 


EBX/BX/BL (386) 


11 Oil 


C3 


CB 


D3 


DB 


E3 


EB 


F3 


FB 


ESP/SP/AH (386) 


100 


C4 


CC 


D4 


DC 


E4 


EC 


F4 


EC 


EBP/BP/CH(386) 


101 


C5 


CD 


D5 


DD 


E5 


ED 


F5 


FD 


ESI/SI/DH (386) 


110 


C6 


CE 


D6 


DE 


E6 


EE 


F6 


FE 


EDI/DI/BH (386) 


111 


C7 


CF 


D7 


DF 


E7 


EF 


F7 


FF 



disp8 denotes an 8-bit displacement following the ModR/M byte, to be sign-extended and 
added to the index. displ6 denotes a 16-bit displacement following the ModR/M bjrte, to be 
added to the index. Defatilt segment register is SS for the effective addresses containing a BP 
index, DS for other effective addresses. 



rable 4.3 32-bit addressing forms with ModR/l\/l byte (80386 only; 


1 








r8(/r) 


AL 


CL 


DL 


BL 


AH 


CH 


DH 


BH 






rl6(/r) 


^ AX 


CX 


DX 


BX 


SP 


BP 


SI 


DI 






r32(/r)' 


EAX 


ECX 


EDX 


EBX 


ESP 


EBP 


ESI 


EDI 






/digit(opcode) 





1 


2 


3 


4 


5 


6 


7 






REG = 


000 


001 


010 


Oil 


100 


101 


110 


111 






Effective address 


ModR/M 

000 


Mod 

00 


R/M values i 


n hexadecimal 

18 20 28 


30 




[EAX] 


08 


10 


38 


[ECX] 




001 


01 


09 


11 


19 


21 


29 


31 


39 


[EDX] 




010 


02 


OA 


12 


lA 


22 


2A 


32 


3A 


[EBX] 


00 


oil 


03 


OB 


13 


IB 


23 


2B 


33 


3B 


[--][-] 




100 


04 


OC 


14 


IC 


24 


2C 


34 


3C 


disp32 




101 


05 


OD 


15 


ID 


25 


2D 


35 


3D 


[ESI] 




110 


06 


OE 


16 


IE 


26 


2E 


36 


3E 


[EDI] 




111 


07 


OF 


17 


IF 


27 


2F 


37 


3F 


disp8[EAX] 




000 


40 


48 


50 


58 


60 


68 


70 


78 


disp8[ECX] 




001 


41 


49 


51 


59 


61 


69 


71 


79 


disp8[EDX] 




010 


42 


4A 


52 


5A 


62 


6A 


72 


7A 


disp8[EPX]; 


01 


on 


43 


4B 


53 . 


5B 


63 


6B 


73 


7B 


disp8[- -][--] 




100 


44 


4C 


54 


5C 


64 


6C 


74 


7C 


disp8[EBP] 




101 


45 


4D 


55 


5D 


65 


6D 


75 


7D 


disp8[ESI] 




no 


46 


4E 


56 


5E 


66 


6E 


76 


7E 


disp8[EDI] 




111 


47 


4F 


57 


5F 


67 


6F 


T7 


7F 


disp32[EAX] 




000 


80 


88 


90 


98 


AO 


A8 


BO 


B8 
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Table 4.3 32-bit addressing forms 

Effcclive address ModR/M 

disp32iECX] 

disp32[EDX] 

disp32[EBX] 10 

disp32[- -][--] 

disp32[EBP] 

disp32[ESI] 

disp32[EDI] 

EAX/AX/AL 

ECX/CX/CL 

EDX/DX/DL 

EBX/BX/BL 11 

ESP/SP/AH 

EBP/BP/CH 

ESI/SI/DH 

EDI/DI/BH 



with IVIodR/M byte (80386 only) (continued) 

ModK/M values in hexadecimal 



001 


81 


89 


91 


99 


Al 


A9 


Bl 


B9 


010 


82 


8A 


92 


9A 


A2 


AA 


B2 


BA 


on 


83 


8B 


93 


9B 


A3 


AB 


B3 


BB 


100 


84 


8C 


94 


9C 


A4 


AC 


B4 


BC 


101 


85 


8D 


95 


9D 


A5 


AD 


B5 


BD 


no 


86 


8E 


96 


9E 


A6 


AE 


B6 


BE 


111 


87 


8F 


97 


9F 


A7 


AF 


B7 


BE 


000 


CO 


C8 


DO 


D8 


EO 


E8 


FO 


F8 


001 


CI 


C9 


Dl 


D9 


El 


E9 


Fl 


F9 


010 


C2 


CA 


D2 


DA 


E2 


EA 


F2 


FA 


on 


C3 


CB 


D3 


DB 


E3 


EB 


F3 


FB 


100 


C4 


CC 


D4 


DC 


E4 


EC 


F4 


EC 


101 


C5 


CD 


D5 


DD 


E5 


ED 


F5 


FD 


no 


C6 


CE 


D6 


DE 


E6 


EE 


F6 


FE 


111 


C7 


CF 


D7 


DF 


E7 


EF 


F7 


FF 



[- -] [- -] means a SIB follows *ie ModR/M byte. disp8 denotes an 8-bit displacement 
following the SIB byte, to be sign-extended and added to the index. disp32 denotes a 32-bit 
displacement following the ModR/M byte, to be added to the index. 



Table 4.4 


32-bit addressing forms with SIB byte (80386 only) 










r32 


EAX 


ECX 


EDX 


EBX 


ESP 


[*] 


ESI 


EDI 






Base = 





1 


2 


3 


4 


5 


6 


7 






Base = 


000 001 
SS index 


010 on 

ModR/M va 


100 


101 


110 
imal 


111 






Scaled inde7> 


lues in 


heKadec 




[EAX] 




000 


00 


01 


02 


03 


04 


05 


06 


07 


[ECX] 




001 


08 


09 


OA 


OB 


OC 


OD 


OE 


■ OF 


[EDX] 




010 


10 


11 


12 


13 


14 


15 


16 


17 


[EBX] 


00 


on 


18 


19 


lA 


IB 


IC 


ID 


IE 


IF 


none 




100 


20 


21 


22 


23 


24 


25 


26 


27 


[EBP] 




101 


28 


29 


2A 


2B 


2C 


2D 


2E 


2F 


[ESI] 




no 


30 


31 


32 


33 


34 


35 


36 


37 


[EDI] 




111 


38 


39 


3A 


3B 


3C 


3D 


3E 


3F 


[EAX*2] 




000 


40 


41 


42 


44 


44 


45 


46 


47 


[ECX*2] 




001 


48 


49 


4A 


4B 


4C 


4D 


4E 


4F 


[EDX*2] 




010 


50 


51 


52 


55 


54 


55 


56 


57 


[EBX*2] 


01 


on 


58 


59 


5A 


5B 


5C 


5D 


5E 


5F 


none 




100 


60 


61 


62 


63 


64 


65 


66 


67 


[EBP*2] 




101 


68 


69 


6A 


6B 


6C 


6D 


6E 


6F 


[ESP2] 




no 


70 


71 


72 


73 


74 


75 


76 


77 


[EDP2] 




111 


78 


79 


7A 


7B 


7C 


7D 


7E 


7F 


[EAX*4] 




000 


80 


81 


82 


83 


84 


85 


86 


87 


[ECX*4] 




001 


88 


89 


8A 


8B 


8C 


8D 


8E 


8F 


[EDX*4] 




010 


90 


91 


92 


93 


94 


95 


96 


97 


[EBX*4] 


10 


on 


98 


89 


9A 


9B 


9C 


9D 


9E 


9F 


none 




100 


AO 


Al 


A2 


A3 


A4 


A5 


A6 


A7 


[EBP*4] 




101 


A8 


A9 


AA 


AB 


AC 


AD 


AE 


AF 


[ESF4] 




no 


BO 


Bl 


B2 


B3 


B4 


B5 


B6 


B7 
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Table 4.4 32-bit addressing forms with SIB byte (80386 only) (continued) 



Scaled index 


SS index 

111 


ModR/M va 

B8 B9 


lues in 


hexadecimal 








[EDF4] 


BA 


BB 


BC 


BD 


BE 


BE 


[EAX*8] 




000 


CO 


CI 


C2 


C3 


C4 


C5 


C6 


C7 


[ECX*8] 




001 


C8 


C9 


CA 


CB 


cc 


CD 


CE 


CF 


[EDX*8] 




010 


DO 


Dl 


D2 


D3 


D4 


D5 


D6 


D7 


[EBX*8] 


11 


oil 


D8 


D9 


DA 


DB 


DC 


DD 


DE 


DF 


none 




100 


EO 


El 


E2 


E3 


E4 


E5 


E6 


E7 


[EBP*8] 




101 


E8 


E9 


EA 


EB 


EC 


ED 


EE 


EF 


[ESF8] 




110 


FO 


Fl 


F2 


F3 


F4 


F5 


F6 


F7 


[EDF8] 




111 


F8 


F9 


FA 


FB 


FC 


FD 


FE 


FF 



[*] means a disp32 with no base if MOD is 00; otherwise, [ESP]. This provides the following 

addressing modes: 

disp32[index](MOD=00) 

disp8[EBP][index](MOD=01) 

disp32[EBP][index](MOD=10) 

How to read the instruction set pages 

Here's a sample of the format of this chapter: 

Instruction What the instruction name means 
name What processor the instruction worl(s on 



Flag information goes here 

Opcode Instruction Clocks 

386 286* 86 

This table contains clock information 

*Because the 80186 processor is effectively a 80286 without protected mode instructions, the 
80186 timirigs are identical to the timings listed for the 80286. 



Flags 



Each entry in this section includes information on which flags in the 80x86's flag 
register are changed and how. Each flag has a one-letter tag for its name. 

= Overflow flag Z = Zero flag 

D = Direction flag A = Auxiliary flag 

1 = Interrupt flag P = Parity flag 
T = Trap flag C = Carry flag 
S = Sign flag 

The following symbols indicate how the flag register has changed: 

? = Undefined after the operation 

* = Changed to reflect the results of the instruction 

= Always cleared 

1 = Always set 
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Opcode 



The "Opcode" column gives the complete object code produced for each form 
of the instruction. When possible, the codes are given as hexadecimal bytes, in 
the same order in which they appear in memory. Definitions of entries other 
than hexadecimal bytes are as follows: 

/digit 

(digit is between and 7.) Indicates that the ModR/M byte of the instruction 
uses only the r/m (register or memory) operand. The reg field contains the digit 
that provides an extension to the instruction's opcode. 

/r 

Indicates that the ModR/M byte of the instruction contains both a register 

operand and an rim operand. 

cb, cw, cd, cp 

A 1-byte (cb), 2-byte (cw), 4-b5^e (cd), or 6-byie (cp) value following the opcode 
that is used to specify a code offset and possibly a new value for the code 
segment register. 

ib, iw, id 

A 1-byte (ib), 2-byte (iw), or 4-byte (id) immediate operand to the instruction 
that follows the opcode, ModR/M bytes, or scale-indexing bytes. The opcode 
determines if the operand is a signed value. All words and doublewords are 
given with the low-order byte first. 

+rb, +rw, +rd 

A register code, from through 7, added to the hexadecimal byte given at the 

left of the plus sign to form a single opcode byte. The codes are 



rb 


rw 


rd (386) 


AL = 


AX = 


EAX = 


CL = 1 


CX = 1 


ECX = 1 


DL = 2 


DX = 2 


EDX = 2 


BL = 3 


BX = 3 


EBX = 3 


AH = 4 


SP = 4 


ESP = 4 


AH = 4 


SP = 4 


ESP = 4 


CH = 5 


BP = 5 


EBP = 5 


DH = 6 


SI = 6 


ESI = 6 


BH = 7 


DI = 7 


EDI = 7 


Instruction 


1 





The "Instruction" column gives the syntax of the instruction statement as it 
would appear in a TASM 80386 program. The following is a list of the symbols 
used to represent operands in the instruction statements: 

rel8 

A relative address in the range from 128 bytes before the end of the instruction 
to 127 bytes after the end of me instruction. 

rell6,rel32 

A relative address within the same code segment as the instruction assembled. 
rell6 applies to instructions with an operand-size attribute of 16 bits; rel32 
applies to instructions with an operand-size attribute of 32 bits (386 only). 
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ptrl6:16, ptrl6:32 

A far pointer, typically in a code segment different from that of the instruction. 
The notation 16:16 indicates that the value of the pointer has two parts. The 
value to the right of the colon is a 16-bit selector or value destined for the code 
segment register. The value to the left corresponds to the offset within the 
destination segment. ptrl6:16 is used when tine instruction's operand-size 
attribute is 16 bits; ptrl6:32 is used with the 32-bit attribute (80386 only). 

r8 

One of the byte registers AL, CL, DL, BL, AH, CH, DH, or BH. 

rl6 

One of the word registers AX, CX, DX, BX, SP, BP, SI, or DI. 

r32 (386) 

One of the doubleword registers EAX, ECX, EDX, EBX, ESP, EBP, ESI, or EDI. 

iinmS 

An immediate byte value. immS is a signed number between -128 and +127 
inclusive. For instructions in which immS is combined with a word or 
doubleword operand, the immediate value is sign-extended to form a word or 
doubleword. The upper byte of the word is filled with the topmost bit of the 
immediate value. 

iinml6 

An immediate word value used for instructions whose operand-size attribute is 
16 bits. This is a number between -32,768 and +32,767 inclusive. 

imm32 (386) 

An immediate doubleword value used for instructions whose operand-size 
attribute is 32 bits. It allows the use of a number between +2,147,483,647 and 
-2,147,483,648. 

r/m8 

A 1-byte operand that is either the contents of a byte register (AL, BL, CL, DL, 
AH, BH, CH, DH), or a byte from memory. 

r/ml6 

A word register or memory operand used for instructions whose operand-size 
attribute is 16 bits. The word registers are AX, BX, CX, DX, SP, BP, SI, DI. The 
contents of memory are found at the address provided by the effective address 
computation. 

r/m32 

A doubleword register or memory operand used for instructions whose 
operand-size attribute is 32 bits, the doubleword registers are EAX, EBX, ECX, 
EDX, ESP, EBP, ESI, EDI. The contents of memory are found at the address 
provided by the effective address computation. 

mS 

A memory byte addressed by DS:SI or ES:DI (used only by string instructions 
on tiie 80386). 

ml6 

A memory word addressed by DS:SI or ES:DI (used only by string instructions). 

m32 

A memiory doubleword addressed by DS:SI or ES:DI (used only by string 
instructions). 

ml6:16, ml6:32 (80386) 

A memory operand containing a far pointer composed of two numbers. The 
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nvimber to the left of the colon corresponds to the pointer's segment selector. 
The number to the right corresponds to its offset. 

ml6 & 32, ml6 & 16 (80186/80286/80386), m32 & 32 (80386) 
A mem^ory operand consisting of data item pairs whose sizes are indicated on 
the left and the right side of the ampersand. All memory addressing modes are 
allowed. ml6 & 16 and m32 & 32 operands are used by the BOUND instruction 
to provide an operand containing an upper and lower bounds for array indices. 
ml6 & 32 is used by LIDT and LGDT to provide a word with which to load the 
limit field, and a doubleword with which to load the base field of the 
corresponding Global and Interrupt Descriptor Table Registers. 

mof f s8, mof f sl6, m^of f s32 (memory offset; 80386 only) 

A simple memory variable of type BYTE, WORD, or DWORD (80386) used by 
some variants of the MOV instruction. The actual address is given by a simple 
offset relative to the segment base. No ModR/M byte is used in the instruction. 
The number shown with mof f s indicates its size, which is determined by the 
address-size attribute of the instruction. 

Sreg 

A segment register. The segment register bit assignments are ES = 0, CS = 1, 
SS = 2, DS = 3, FS = 4 (80386), and GS = 5 (80386). 

Clocks 

The "Clocks" column gives the number of clock cycles the instruction takes to 
execute. The clock count calculations make the following assumptions: 

• The instruction has been prefetched and decoded and is ready for execution. 

• Bus cycles do not require wait states. 

• There are no local bus HOLD requests delaying processor access to the bus. 

• No exceptions are detected during instruction execution. 

• Memory operands are aligned. 

Clock counts for instructions that have an rim (register or memory) operand are 
separated by a slash. The count to the left is used for a register operand; the 
count to the right is used for a memory operand. 

The following symbols are used in the clock count specifications: 

• n, which represents a number of repetitions. 

• m, which represents the number of components in the next instruction 
executed, where the entire displacement (if any) counts as one component, 
the entire immediate data (if any) counts as one component, and every other 
byte of the instruction and prefix(es) each counts as one component. 

• pm=, a clock coiint that applies when the instruction executes in protected 
mode. pm= is not given when the clock counts are the same for protected 
and real address modes. 

When an exception occurs during the execution of an instruction and the 
exception handler is in another task, the instiuction exception time is increased 
by the number of clocks to effect a task switch. This parameter depends on 
several factors: 

• The t5rpe of TSS used to represent the current task (386 TSS or 286 TSS). 

• The type of TSS used to represent the new task. 

• Whether the current task is in V86 mode. 

• Whether the new task is in V86 mode. 
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Note: Users should read Litel's documentation for more information about 
protected mode and task switching. 



AAA 



ASCII adjust after addition 





D 
7 


I T 


S Z A 
? ? * 


P C 
? * 




opcode 


Instruction 


¥''Mm^ 


Clocks 




Description 






486 


386 286 


86 




37 


AAA 


3 


4 3 


8 


ASCn adjust after addition 



Execute AAA only following an ADD instruction that leaves a byte result in the 
AL register. The lower nibbles of the operands of the ADD instruction should 
be in the range through 9 (BCD digits). In this case, AAA adjusts AL to 
contain the correct decimal digit result. If the addition produced a decimal 
carry, the AH register is incremented, and the carry and auxiliary carry flags are 
set to 1. If there was no decimal carry, the carry and auxiliary flags are set to 
and AH is unchanged. In either case, AL is left with its top nibble set to 0. To 
convert AL to an ASCII result, follow the AAA instruction with OR AL, 30H. 



AAD 



ASCII adjust before division 





D I 
J 

Instruction 

486 

AAD 14 


T S Z 
* * 

Clocks 

386 286 

19 14 


A 
•> 


P 
* 


C 
7 


opcode 

D5 0A 


86 

60 


Description 

ASCII adjust before division 



AAD is used to prepare two unpacked BCD digits (the least-significant digit in 
AL, the most-significant digit in AH) for a division operation that will yield an 
unpacked result. This is accomplished by setting AL to AL + (10 * AH), and 
then setting AH to 0. AX is then equal to the binary equivalent of the original 
unpacked two-digit number. 



AAM 



ASCII adjust AX after multiply 





D I 


T S Z 


A 


P 


C 




7 


* * 


7 


* 


? 


Opcode 


Instruction 


Clocks 






Description 




486 


386 286 




86 




D4 0A 


AAM 15 


17 16 




83 


ASCII adjust AX after multiply 



Execute AAM only after executing a MUL instruction between two unpacked 
BCD digits that leaves the result in the AX register. Because the result is less 
than 100, it is contained entirely in the AL register. AAM unpacks the AL result 
by dividing AL by 10, leaving the quotient (most-significant digit) in AH and 
the remainder (least-significant digit) in AL. 
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AAS 



ASCII adjust AL after subtraction 





D I 


T S Z 


A 


P 


C 




? 


? ? 


* 


J 


* 


Opcode 


Instruction 


Clocks 
386 286 




86 


Description 




486 




3F 


AAS 3 


4 3 




8 


ASCn adjust AL after subtraction 



Execute AAS only after a SUB instruction that leaves the byte result in the AL 
register. The lower nibbles of the operands of the SUB instruction must have 
been in the range through 9 (BCD digits). In this case, AAS adjusts AL so it 
contains the correct decimal digit result. If the subtraction produced a decimal 
carry, the AH register is decremented, and the carry and auxiliary carry flags 
are set to 1. If no decimal carry occurred, the carry and auxiliary carry flags are 
set to 0, and AH is imchanged. In either case, AL is left with its top rubble set to 
0. To convert AL to an ASCII result, follow the AAS with OR AL, 30H. 



ADC 



Add with carry 



Opcode 


Instruction 






ClOCkSr 








486 


386 


286 


86 


10 /r 


ADC r/m8,r8 


1/3 


2/7 


2/7 


3/16+EA 


11 /r 


ADC r/ml6,rl6 


1/3 


2/7 


2/7 


3/16+EA 


11 /r 


ADC r/m32,r32 


1/3 


2/7 






12 /r 


ADC r8,r/m8 


1/2 


2/6 


2/7 


3/9+EA 


13 /r 


ADC rl6,r/ml6 


1/2 


2/6 


2/7 


3/9+EA 


13 /r 


ADC r32,r/m32 


1/2 


2/6 






14 ib 


ADC AL,imm8 


1 


2 


3 


4 


15 iw 


ADC AX,iOTml6 


1 


2 


3 


4 


15 id 


ADC EAX,iinm32 


1 


2 






80/2ib 


ADC r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


81/2iw 


ADC r/ml6,iiranl6 


1/3 


2/7 


3/7 


4/17+EA 


81/2 id 


ADC r/m32,inmi32 


1/3 


2/7 






83/2ib 


ADC r/ml6,imm8 


1/3 


2/7 


3/7 


4/17+EA 


83/2ib 


ADC r/m32,inun8 


1/3 


2/7 







Description 



Add with carry byte register to 
r/mbyte 

Add witii carry word register to 
r/m word 

Add with CF dword register to 
r/m word 

Add with carry r/m byte to byte 
register 

Add with carry r/m word to 
word register 

Add with CF r/m dword to 
dword register 

Add with carry immediate byte to 
AL 

Add with carry immediate word 
toAX 

Add with carry iimnediate dword 
toEAX 

Add with carry iiranediate byte to 
r/m b5^e 

Add with carry iimnediate word 
to r/m word 

Add with CF immediate dword 
to r/m dword 

Add with CF sign-exterided 
immediate byte to r/m word 

Add with CF sign-extended 
iminediate byte into r/m dword 



ADC performs an integer addition of the two operands DEST and SRC and the 
carry flag, CF. The result of the addition is assigned to the first operand (DEST), 
and the flags are set accordingly. ADC is usually executed as part of a 
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multi-byte or multi-word addition operation. When an immediate byte value is 
added to a word or doubleword operand, the immediate value is first sign- 
extended to the size of the word or doubleword operand. 



ADD 



Add 





D 


I T 


S 


Z A 


P C 






* 




* 


* * 


* * 




Opcode 


Instruction 






Clocks 




Description 






486 


386 


286 


86 




04 ib 


ADD AL,imm8 


1 


2 


3 


4 


Add immediate byte to AL 


05 iw 


ADD AX,iminl6 


1 


2 


3 


4 


Add immediate word to AX 


05 id 


ADDEAX,iirun32 


1 


2 






Add immediate dword to EAX 


80 /Gib 


ADDr/ni.8,inun8 


1/3 


2/7 


3/7 


4/17+EA 


Add immediate byte to r/m 
byte 


81 /O iw 


ADD r/ml6,imml6 


1/3 


2/7 


3/7 


4/17+EA 


Add immediate word to r/m 
word 


81/0 id 


ADDr/m32,inun32 


1/3 


2/7 






Add immediate dword to r/m 
dword 


83 /O ib 


ADpr/ml6,imin8 


1/3 


2/7 


3/7 


4/17+EA 


Add sign-exterided immediate 
byte to r/m word 


83 /O ib 


ADD r/m32,imin8 


1/3 


2/7. 






Add sign-extended immediate 
byte to r/m dword 


00 /r 


ADD r/m8,r8 


1/3 


2/7 


2/7 


3/16+EA 


Add byte register to r/m byte 


01 /r 


ADD r/ml6,rl6 


1/3 


2/7 


2/7 


3/16+EA 


Add word register to r/m 
word 


01 /r 


ADD r/m32,r32 


1/3 


2/7 






Add dword register to r/m 
dword 


02 /r 


ADD r8,r/m8 


1/2 


2/6 


2/7 


3/9+EA 


Add r/m byte to byte register 


03 /r 


ADD rl6,r/ml6 


1/2 


2/6 


2/7 


3/9+EA 


Add r/m word to word 
register 


03 /r 


ADD r32,r/m32 


1/2 


2/6 






Add r/m dword to dword 
register 



ADD performs an integer addition of the two operands (DEST and SRC). The 
result of the addition is assigned to the first operand (DEST), and the flags are 
set accordingly. 

When an immediate byte is added to a word or doubleword operand, the 
immediate value is sign-extended to the size of the word or doubleword 
operand. 



AND 



Logical AND 





D 


I T 


S 


Z A 


P C 











* 


* ? 


* 




Opcode 


Instruction 


486 


386 


Clocks 




Description 




286 


86 




20 /r 


AND r/m8,r8 


1/3 


2/7 


2/7 


3/16+EA 


AND byte register into r/m 
byte 


21 /r 


ANDr/ml6,rl6 


1/3 


2/7 


2/7 


3/16+EA 


AND word register into r/m 
word 


21 /r 


AND r/m32,r32 


1/3 


2/7 






AND dword register to r/m 



dword 
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opcode 


Instruction 


486 




Clocks 


86 


Description 




386 


286 




22 /r 


ANDr8,r/m8 


1/2 


2/6 


2/7 


3/9+EA 


AND r/m byte to byte 
register 


23 /r 


ANDrl6,r/ml6 


1/2 


2/6 


2/7 


3/9+EA 


AND r/m word to word 
register 


23 /r 


ANDr32,r/m32 


1/2 


2/6 






AND r/m dword to dword 
register 


24 ib 


ANDAL,iinin8 


1 


2 


3 


4 


AND immediate byte to AL 


25 iw 


ANDAX,imml6 


1 


2 


3 


4 


AND immediate word to AX 


25 id 


ANDEAX,imm32 


1 


2 






AND immediate dword to 
EAX 


80 /4 ib 


ANDr/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


AND immediate byte to r/m 
byte 


81/4iw 


AND r/ml6,iiranl6 ■ 


1/3 


2/7 


3/7 


4/17+EA 


AND immediate word to 
r/m word 


81/4 id 


ANDr/m32,imm32 


1/3 


2/7 






AND immediate dword to 
r/m word 


83/4ib 


ANDr/ml6,iimn8 


1/3 


2/7 


3/7 


4/17+EA 


AND sign-extended 
immediate byte with r/m 
word 


83/4ib 


AND r/m32,iirun8 


1/3 


2/7 






AND sign-extended 
immediate byte with r/m 
dword 



Each bit of the result of the AND instruction is a 1 if both corresponding bits of 
the operands are 1; otherwise, it becomes a 0. 

The optimized form of AND is MASKFLAG (see Chapter 3). 



ARPL 



Adjust RPL field of selector 

80286 and greater protected mode only 



opcode Instruction 



63 /r 



ARPLr/ 
ml6,rl6 



Clocks Description 

486 386 286 

9/9 pm=20/21 pm=10/ll Adjust RPL of r/ml6 to not less than 
RPLofrl6 



The ARPL instruction has two operands. The first operand is a 16-bit memory 
variable or word register that contains the value of a selector. The second 
operand is a word register. If the RPL field ("requested privilege level" — 
bottom two bits) of the first operand is less than the RPL field of the second 
operand, the zero flag is set to 1 and the RPL field of the first operand is 
increased to match the second operand. Otherwise, the zero flag is set to and 
no change is made to the first operand. 

ARPL appears in operating system software, not in application programs. It is 
used to guarantee tiiat a selector parameter to a subroutine does not request 
more privilege than the caller is allowed. The second operand of ARPL is 
normally a register that contains the CS selector value of the caller. 
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BOUND Check array index against bounds 

80186 processors and greater 





D 


I T 


S 


Z A 


P C 


Opcode 


Instruction 




Clocks 


Description 






486 


386 


286 




62 /r 


BOUNDrl6,7 


7 


10 


13 


Check if rl6 is within ml6&16 bounds 
(passes test) 


62 /r 


BOUND r32, 7 


7 


10 




Check if r32 is within m32&32 bounds 
(passes test) 



BOUND ensures that a signed array index is within the limits specified by a 
block of memory consisting of an upper and a lower bound. Each bound uses 
one word for an operand-size attribute of 16 bits and a doubleword for an 
operand-size attribute of 32 bits. The first operand (a register) must be greater 
than or equal to the first bound in memory (lower bound), and less than or 
equal to the second bound in memory (upper bound). If the register is not 
within bounds, an Interrupt 5 occurs; the return EIP points to tihe BOUND 
instruction. 

The bounds limit data structure is usually placed just before the array itself, 
making the limits addressable via a constant offset from the beginning of the 
array. 



BSF 



Bit scan forward 

386 processors and greater 



Opcode Instruction 



OFBC 
OFBC 



BSF rl6,r/ml6 
BSFr32,r/m32 



Clocks 

486 386 

6-42/7-43 10+3n 
10+3n 



Description 

Bit scan forward on r/m word 
Bit scan forward on r/m dword 



BSF scans the bits in the second word or doubleword operand starting with bit 
0. The ZF flag is cleared if the bits are all 0; otherwise, the ZF flag is set and the 
destination register is loaded with the bit index of the first set bit. 



BSR 



Bit scan reverse 

386 processors and greater 





D 


I T 


S Z A P 
* 

Clocks 


C 


Opcode 


Instruction 

BSRrl6,r/ml6 
BSRr32,r/m32 


Description 


OFBD 
OFBD 


486 386 

6-103/7-104 10+3n 
6-103/7-104 10+3n 


Bit scan reverse on r/m word 
Bit scan reverse on r/m dword 



BSR scans the bits in the second word or doubleword operand from the most 
significant bit to the least significant bit. The ZF flag is cleared if the bits are 
all 0; otherwise, ZF is set and the destination register is loaded with the bit 
index of the first set bit found when scanning in the reverse direction. 
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BSWAP Byte Swap 

i486 processors and greater 



Opcode Instruction 



0FC8/r BSWAP r32 



Clock Description 

486 



Swap b5^es to convert little/big endian data in a 32- 
bit register to big/little endian form. 



BSWAP reverses the bj^e order of a 32-bit register, converting a value in little/ 
big endian form to big/little endian form. When BSWAP is used with a 16-bit 
operand size, the result left in the destination register is undefined. 



BT 



Bit test 

386 processors and greater 



Opcode 

OF A3 
OF A3 
0FBA/4ib 
0FBA/4ib 



Instruction 


c: 


locks 
386 


Description 




486 




BTr/ml6,rl6 


3/8 


3/12 


Save bit in carry flag 


BTr/m32,r32 


3/8 


3/12 


Save bit in carry flag 


BT r/ml6,imm8 


3/3 


3/6 


Save bit in carry flag 


BT r/m32,iirvin8 


3/3 


3/6 


Save bit in carry flag 



BT saves the value of the bit indicated by the base (first operand) and the bit 
offset (second operand) into the carry flag. 



BTC 



Bit test and complement 
386 processors and greater 



Opcode Instruction Clocks Description 

486 386 

OFBB BTC r/ml6,rl6 6/13 6/13 Save bit in carry flag and complement 

OFBB BTCr/m32,r32 6/13 6/13 Save bit in carry flag and complement 

0FBA/7ib BTC r/ml6,imm8 6/8 6/8 Save bit in carry flag and complement 

0FBA/7ib BTC r/m32,imm8 6/8 6/8 Save bit in carry flag and complement 

BTC saves the value of the bit indicated by the base (first operand) and the bit 
offset (second operand) into the carry flag and then complements the bit. 
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BTR 



Bit test and reset 

386 processors and greater 



Opcode Instruction Clocks Description 

486 386 

0FB3 BTRr/ml6,rl6 6/13 6/13 Save bit in carry flag and reset 

0FB3 BTRr/m32,r32 6/13 6/13 Save bit in carry flag and reset 

0FBA/6ib BTR r/ml6,imm8 6/8 6/8 Save bit in carry flag and reset 

0FBA/6ib BTR r/m32,iimii8 6/8 6/8 Save bit in carry flag and reset 

BTR saves the value of the bit indicated by the base (first operand) and the bit 
offset (second operand) into the carry flag and then stores in the bit. 



BTS 



Bit test and set 

386 processors and greater 



Opcode 


Instruction 


Clocks 

486 386 


OFAB 


BTSr/ml6,rl6 


6/13 6/13 


OFAB 


BTSr/m32,r32 


6/13 6/13 


OF BA /5 ib 


BTSr/ml6,imm8 


6/8 6/8 


OF BA /5 ib 


BTS r/m32,imm8 


6/8 6/8 



Description 

Save bit in carry flag and set 
Save bit in carry flag and set 
Save bit in carry flag and set 
Save bit in carry flag and set 



BTS saves the value of the bit indicated by the base (first operand) and the bit 
offset (second operand) into the carry flag and then stores 1 in the bit. 



CALL 



Call Procedure 



All flags are affected if a task switch occurs; no flags are affected if a task switch 
does not occur. 



Opcode 


Instruction 




Clocks 




Description 






486 


386 


286* 


86 




E8cw 


CALLrell6 


3 


7+m 


7 


19 


Call near, 
displacement 
relative 
to next 
instruction 


FF/2 


CALLr/ml6 


5/5 


7+m/lO+m 


7/11 


16/21+EA 


Call near, 
' register 
indirect/ 
memory 
indirect 


9Acd 


CALLptrl6:16 


18,pm=20 


17+m, 
pm=34=m 


13, 
pm=26 


28 


CaU 

intersegment, 
to fuU pointer 
given 


9Acd 


CALLptrl6:16 


pm=35 


pm=52+m 


41 




Call gate, 
same privilege 
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OpuuK' liisli-uction Clocks 

486 386 286* 86 

9Acd CALLptrl6:16 pm=69 pm=86+m 82 

9Acd CALLptrl6:16 pm=77+4x pm=94+4x+m 86+4x 



9Acd CALLptrl6:16 pm=37+ts ts 



177/182 



FF/3 CALLml6:16 17,pm=20 22+m,pm38+m 16/29 37+EA 

FF/3 CALLml6:16 pm=35 pm=56+m 44 

FF/3 CALLml6:16 pm=69 pm=90+m 83 

FF/3 CALLml6:16 pm=77+4x pm=98+4x+m 90+4x+m 



FF/3 CALLml6:16 pm=37+ts 5 + ts 



180/185 



E8cd CALLrel32 3 



7+m 



FF/2 CALLr/m32 5/5 7+m/lO+m 



9Acp CALLptrl6:32 18,pm=20 17+m,pm= 

34+m 



9Acp CALL ptrl6:32 pm=35 pm=52+m 

9Acp CALLptrl6:32 pm=69 pm=86+m 

9Aq) CALLptr32:32 pm=77+4x pm=94+4x+m 



9Acp CALLptrl6:32 pm=37+ts ts 

FF/3 CALLml6:32 17,pm=20 22+m,pm=38+ 



FF/3 CALLml6:32 pm=35 pm=56+m 

FF/3 CALLml6:32 pm=69 pm=90+m 



Description 



Call gate, 
more 

privilege, rio 
parameters 

Call gate, 
more 

privilege, x 
parameters 

Call to task 
(via task state 
segment/task 
gate for 286 

CaU 

intersegment, 
address at 
r/m dword 

Call gate, 
same privilege 

Call gate, 
more 

privilege, no 
parameters 

Call gate, 
more 

privilege, x 
parameters 

Call to task 
(via task state 
segment/task 
gate for 286) 

CaU near, 
displacement 
relative to next 
instruction 

Call near, 
indirect 

Call 

intersegment, 
to fuU pointer 
given 

Call gate, 
same privilege 

CaU gate, 
more 

privilege, no 
parameters 

CaU gate, 
more 

privilege, x 
parameters 

CaU to task 

CaU 

intersegment, 
address at 
r/m dword 

CaU gate, 
same privilege 

CaU gate, 
more 

privilege, no 
parameters 
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opcode Instruction Clocks Description 

486 386 286* 86 

FF/3 CALLml6:32 pm=77+4x pin=98+4x+m Call gate, 

more 

privilege, x 
parameters 

FF/3 CALLml6:32 pm=37+ts 5 + ts Call to task 

*Add one clock for each byte in the next instruction executed (80286 only). 

The CALL instruction causes the procedure named in the operand to be 
executed. When the procedure is complete (a return instruction is executed 
within the procedure), execution continues at the instruction that follows the 
CALL instruction. 

The action of the different forms of the instruction are described next. 

Near calls are those with destinations of type r/ml6, r/m32, rell6, rel32; 
changing or saving the segment register value is not necessary. The CALL rell6 
and CALL rel32 forms add a signed offset to the address of the instruction 
following CALL to determine the destination. The rell6 form is used when the 
instruction's operand-size attribute is 16 bits; rel32 is used when the operand- 
size attribute is 32 bits. The result is stored in the 32-bit EIP register. With rel 16, 
the upper 16 bits of EIP are cleared, resulting in an offset whose value does not 
exceed 16 bits. CALL r/ml6 and CALL r/m32 specify a register or memory 
location from which the absolute segment offset is fetched. The offset fetched 
from r/m is 32 bits for an operand-size attribute of 32 (r/m32), or 16 bits for an 
operand-size of 16 (r/ml6). The offset of the instruction following CALL is 
pushed onto the stack. It will be popped by a near RET instruction within the 
procedure. The CS register is not changed by this form of CALL. 

The far calls, CALL ptrl6:16 and CALL ptrl6:32, use a 4-byte or 6-byte operand 
as a long pointer to the procedure called. The CALL ml6:16 and ml6:32 forms 
fetch the long pointer from the memory location specified (indirection). In real 
address mode or virtual 8086 mode, the long pointer provides 16 bits for the CS 
register and 16 or 32 bits for the EIP register (depending on the operand-size 
attribute). These forms of the instruction push both CS and IP or EIP as a return 
address. 

In protected mode, both long pointer forms consult the AR byte in the 
descriptor indexed by the selector part of the long pointer. Depending on the 
value of the AR byte, the call will perform one of the following types of control 
transfers: 

• a far call to the same protection level 

• an inter-protection level far call 

• a task switch 

Note: Turbo Assember extends the syntax of the CALL instruction to facilitate 
parameter passing to high-level language routines. See Chapter 7 of the Turbo 
Assember User's Guide for more details. 

CBW Convert byte to word 



Opcode Instruction Clocks Description 

486 386 286 86 

98 CBW 3 3 2 2 AX sign-extend of AL 



Chapter4, Processor instructions 79 



CBW converts the signed byte in AL to a signed word in AX by extending the 
most significant bit of AL (the sign bit) into all of the bits of AH. 

CDQ Convert doubleword to quadword 

386 processors and greater 

ODITSZAPC 

Opcode Instruction Clocks Description 

486 386 

99 CDQ 3 2 EDXrEAX [(sign-extend of EAX) 

CDQ converts the signed doubleword in EAX to a signed 64-bit integer in the 
register pair EDX:EAX by extending the most significant bit of EAX (the sign 
bit) into all the bits of EDX. 

CLC Clear carry flag _^ 

ODITSZAPC 



Opcode Instruction Clocks 

486 386 286 86 

F8 CLC 2 2 2 2 

CLC sets the carry flag to zero. It does not affect other flags or registers. 

CLD Clear direction flag 

ODITSZAPC 

• 

Opcode Instruction Clocks Description 

486 386 286 86 

C CLD 2 2 2 2 Clear direction flag 

CLD clears the direction flag. No other flags or registers are affected. After CLD 
is executed, string operations will increment the index registers (SI or DI) that 
they use. 

CLI Clear interrupt flag 

ODITSZAPC 


Opcode Instruction Clocks 

486 386 286 86 

FA CLI 5 3 3 2 

CLI clears the interrupt flag if the current privilege level is at least as privileged 
as lOPL. No other flags are affected. External interrupts are not recognized at 
the end of the CLI instruction or from that point on until the interrupt flag is set. 
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CLTS Clear task switched flag 

80286 and greater protected mode only 



ODITSZAPC 

TS = (TS is in CRO, not the flag register) 



Opcode 



OF 06 



Instruction 




Clocks 




486 


386 286 


CLTS 


7 


5 2 



CLTS clears the task-switched (TS) flag in register CRO. This flag is set by the 
386 every time a task switch occurs. The TS flag is used to manage processor 
extensions as follows: 

• Every execution of an ESC instruction is trapped if the TS flag if set. 

• Execution of a WAIT instruction is trapped if the MP flag and the TS flag are 
both set. 

Thus, if a task switch was made after an ESC instruction was begun, the 
processor extension's context may need to be saved before a new ESC 
instruction can be issued. The fault handler saves the context and resets the TS 
flag. 

CLTS appears in operating system software, not in application programs. It is a 
privileged instruction that can or\ly be executed at privilege level 0. 



CMC Complement carry flag 



opcode Instruction Clocks Description 

486 386 286 86 

F5 CMC 2 2 2 2 Complement carry flag 

CMC reverses the setting of the carry flag. No other flags are affected. 

CMP Compare two operands 



Opcode Instruction Clocks Description 

486 386 286 86 

3Cib CMPAL,imm8 1 2 3 4 Compare immediate byte to AL 

3D iw CMP AX,imml6 12 3 4 Compare immediate word from 

AX 

3D id CMPEAX,imm32 1 2 Compare immediate dword to 

EAX 

80/7ib CMPr/m8,imm8 1/2 2/5 3/6 4/10+EA Compare immediate byte to r/m 

byte 

81 /7 iw CMP r/ml6,imml6 1/2 2/5 3/6 4/10+EA Compare immediate word to r/m 

word 

81/7 id CMP r/m32,imm32 1/2 2/5 Compare immediate dword to 

r/m dword 
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Opcode Instruction 

486 

CMPr/ml6,iinm8 1/2 



83/7ib 

83/7ib CMPr/m32,imin8 1/2 2/5 



Clocks 

386 286 86 

2/5 3/6 4/10+EA 



38 /r 
39 /r 



CMP r/m8,r8 
CMPr/ml6,rl6 



1/2 2/5 2/7 3/9+EA 
1/2 2/5 2/7 3/9+EA 



39 /r CMPr/m32,r32 1/2 2/5 



3A/r 
3B/r 



CMPr8,r/m8 
CMPrl6^/m8 



1/2 2/6 2/6 3/9+EA 
1/2 2/6 2/6 3/9+EA 



3B/r CMPr32,r/m32 1/2 2/6 



Description 



Compare sign extended immediate 
byte to r/m word 

Compare sign extended immediate 
byte to r/m dword 

Compare byte register to r/m byte 

Compare word register to r/m 
word 

Compare dword register to r/m 
dword 

Compare r/m byte to byte register 

Compare r/m word to word 
register 

Compare r/m dword to dword 
register 



GMP subtracts the second operand from the first but, unlike the SUB 
instruction, does not store the result; only the flags are changed. CMP is 
typically used in conjunction with conditional jumps and the SETcc instruction. 
If an operand greater than one byte is compared to an immediate byte, the byte 
value is first sign-extended. 



CMPS 
CMPSB 
CMPSW 
CMPSD 

Opcode Instruction 



Compare string operands 

CMPSD 386 processors and greater 



Clocks 

486 386 286 86 

8 10 



Description 



A6 CMPSm8,m8 8 10 8 22 Compare bytes ES:[(E)DI] (second operand) 

witht(E)SIf (first operand) 

A7 CMPSml6,ml6 8 10 8 22 Compare words ES:[(E)DI] (second 

operand) with [(E)SI] (first operand) 

A7 CMPSm32,m32 8 10 Compare dwordsES:[(E)DI] (second 

operand) with [(E)SI] (first operand) 

A6 CMPSB 8 10 8 22 Compare bytes ES:[(E)DI] with OS: [SI] 

A7 CMPSW 8 10 8 22 Compare words ES:[(E)DI] with DS:[SI] 

A7 CMPSD 8 10 Compare dwordsES:[(E)DI] with DS:[SI] 

CMPS compares the byte, word, or doubleword pointed to by the source-index 
register wiih the byte, word, or doubleword pointed to by the destination-index 
register. 

If the address-size attribute of this instruction is 16 bits, SI and DI will be used 
for source- and destination-index registers; otherwise ESI and EDI will be used. 
Load the correct index values into SI and DI (or ESI and EDI) before executing 
CMPS. 

The comparison is done by subtiacting the operand indexed by the destination- 
index register from the operand indexed by the source-index register. 

Note that the direction of subtiaction for CMPS is [SI] - [DI] or [ESI] - [EDI]. 
The left operand (SI or ESI) is the source and the right operand (DI or EDI) is the 
destination. This is the reverse of the usual Intel convention in which the left 
operand is the destination and the right operand is the source. 
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The result of the subtraction is r\ot stored; only the flags reflect the change. The 
types of the operands determine whether bytes, words, or doublewords are 
compared. For the first operand (SI or ESI), the DS register is used, unless a 
segment override byte is present. The second operand (DI or EDI) must be 
addressable from the ES register; no segment override is possible. 

After the comparison is made, both the source-index register and destination- 
index register are automatically advanced. If the direction flag is (CLD was 
executed), the registers increment; if the direction flag is 1 (STD was executed), 
the registers decrement. The registers increment or decrement by 1 if a byte is 
compared, by 2 if a word is compared, or by 4 if a doubleword is compared. 

CMPSB, CMPSW and CMPSD are synonyms for the byte, word, and 
doubleword CMPS instructions, respectively. 

CMPS can be preceded by the REPE or REPNE prefix for block comparison of 
CX or ECX bytes, words, or doublewords. Refer to the description of the REP 
instruction for more information on this operation. 

CMPXCHG Compare and Exchange 

i486 processors and greater 



opcode Instruction Qock Description 

486 

OFBO/r CMPXCHG r/m8,r8 6/7 if comparison Compare AL with r/m byte. If equal, set 

is successful; 6/10 if ZF and load byte reg into r/m byte. Else, 
comparison fails clear ZF and load r/m byte into AL. 

OF Bl/r CMPXCHG r/ml6,rl6 6/7 if comparison Compare AX with r/m word. If equal, set 

is successful; 6/10 if ZF and load word reg into r/m word, 
comparison fails Else, clear ZF and load r/m word into AX. 

OF Bl /r CMPXCHG r/m32,r32 6/7 if comparison Compare FAX with r/m dword. If equal, 

is successful; 6/10 if set ZF and load dword reg into r/m 
comparison fails dword. Else, clear ZF and load r/m dword 
into FAX. 

Note: The A-stepping of the i486 used the opcodes OF A6 and OF A7. 

The CMPXCHG instruction compares the accumulator (AL, AX, or EAX 
register) with DEST. If they are equal, SRC is loaded into DEST. Otherwise, 
DEST is loaded into the accumulator. 

DEST is the destination operand; SRC is the source operand. 

Protected mode exceptions: #GP(0) if the result is in a nonwritable segment; 
#GP(0) for an illegal memory operand effective address in the CS, DS, ES, FS, or 
GS segments; #SS(0) for an illegal address in the SS segment; #PF (fault code) for 
a page fault; #AC for an unaligned memory reference if the current privilege 
level is 3^ 

Real mode exception: interrupt 13 if any part of the operand would lie outside 
the effective address space from to OFFFFh. 

Virtual 8086 mode exceptions: interrupt 13, as in real mode; #PF and #AC, as in 
protected mode. 

Note: This instruction can be used with a LOCK prefix. In order to simplify 
interface to the processor's bus, the destination operand receives a write cycle 
without regard to the result of the comparison. DEST is written back if the 
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comparison fails, and SRC is written into the destination otherwise. (The 
processor never produces a locked read without producing a locked write.) 

CHPXCHG8B Compare and Exchange 8 bytes 

Pentium processors and greater 

ODITSZAPC 



Opcode Instruction Clocks Description 

Pentium 

0FC7 CMPXCHG64 r/m64 10 corripare EDX:EAX with r/m qword. If equal, 

set ZF and load ECX:EBX into r/m qword. 
Else, clear ZF and load r/m into EDX:EAX. 

The CMPXCHG8B instruction compares the 64-bit value in EDXrEAX with 
DEST. EDX contains the high-order 32 bits and EAX contains the low-order 32 
bits of the 64-bit value. If they are equal, the 64-bit value in ECX:EBX is stored 
into DEST. ECX contains the high-order 32 bits and EBX contains the low-order 
32 bits. Otherwise, DEST is loaded into EDX:EAX. 

The ZF flag is set if the destination operand and EDX:EAX are equal; otherwise 
it is cleared. The CF, PF, AF, SF, and OF flags are unaffected. 

Protected mode exceptions: #GP(0) if the result is in a nonwritable segment; 
#GP(0) for an illegal memory operand effective address in the CS, DS, ES, FS, or 
GS segments; #SS(0) for an illegal address in the SS segment; #PF(fault code) for 
a page fault; #AC for unaligned memory reference if tiie current privilege level 
is 3. 

The destination operand must be a memory operand, not a register. If the 
CMPXCHG8B instruction is executed with a modr/m byte representing a 
register as the destination operand, #UD occurs. 

Real mode exception: interrupt 13 if any part of the operand would lie outside 
the effective address space fromi to OFFFFh. 

Virtual 8086 mode exceptions: same exceptions as in real mode, plus #PF(fault 
code) for a page fault; #AC for imaligned memory reference if the ctirrent 
privilege level is 3. #UD if the modr/m byte represents a register as the 
destination. 

Notes: This instruction can be used with a LOCK prefix. In order to simplify 
interface to the processor's bus, the destination operand receives a write cycle 
without regard to the result of the comparison. DEST is written back if the 
comparison fails, and SRC is written into the destination otherwise. (The 
processor never produces a locked read without also producing a locked write.) 

The "r/m64" syntax had previously been used only in the context of floating 
point operations. It indicates a 64-bit value, in memory at an address 
determined by the modr/m byte. 
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CPUID CPU identification 

Pentium processors and greater 



Opcode Instruction Clocks Description 

Pentium 

0FA2 CPUID 14 EAX<-CPOU identification info. 

The CPUID instruction provides information to software about the vendor, 
family, model, and stepping of microprocessor on which it is executing. An 
input value loaded into the EAX register for this instruction indicates what 
information should be returned by the CPUID instruction. 

Following execution of the CPUID instruction with a zero in EAX, the EAX 
register contains the highest input value understood by the CPUID instruction. 
For the Pentium processor, the value in EAX will be one. Also returned is a 
vender identification string contained in the EBX, EDX, and ECX registers. EBX 
contains the first four characters. For Intel processors, the vender identification 
string is "Genuinelntel" as follows: 

EBX— 756e6547h (* "Genu", with 'G' in the low nibble of BL *) 
EDX-^9656e69h (* "inel", with 'i' in the low nibble of DL *) 
ECX— 6c65746eh (* "ntel", with 'n' in the low nibble of CL *) 

Following execution of the CPUID instruction with an, input value of one 
loaded into the EAX register, bits 0-3 in EAX contain the stepping id of the 
microprocessor, bits 4-7 of EAX contain the model (the first model will be 
indicated by a 0001b in these bits) and bits 8-11 of EAX contain the family (5 for 
the Pentium processor family). Bits 12-31 of EAX are reserved, as well as EBX, 
and ECX. The Pentium processor sets the feature register, EDX, to Ibfh, 
indicating which features the Pentium processor supports. A feature flag set to 
one indicates that the corresponding feature is supported. The feature set is 
defined as follows: 

EDX (bit 0) FPU on chip 

EDX (bits 1-6) Nonessential, proprietary information (contact Intel for 

more information) 
EDX (bit 7) Machine Check Exception 

EDX (bit 8) CMPXCHG8B Instruction 

EDX (bits 9-31) Reserved 

Software should determine the vender identification in order to properly 
interpret the feature register flag bits. 

This function does not affect the CPU flags. 

CWD Convert word to doubleword 

386 processors and greater 





D 


I T S 


Z 


A P C 


( )pf ode 


Instruction 


Clocks 




Description 




486 


386 286 


86 




99 


CWD 3 


2 2 


5 


DX: AX <r- sign-extend of AX 



CWD converts the signed word in AX to a signed doubleword in DX: AX by 
extending the most significant bit of AX into all the bits of DX. Note that CWD 
is different from CWDE. CWDE uses EAX as a destination, instead of DX:AX. 
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CWDE 



Convert word to doubleword 
386 processors and greater 



Opcode Instruction Clocks Description 

486 386 286 86 

98 CWDE 3 3 E AX ■«- sign-extend of AX 

CWDE converts the signed word in AX to a doubleword in EAX by extending 
the most significant bit of AX into the two most significant bytes of EAX. Note 
that CWDE is different from CWD. CWD uses DX: AX rather than EAX as a 
destination. 



DAA 



Decimal adjust AL after addition 



A P 



Opcode Instruction 



27 



DAA 



486 

2 



Clocks 

386 286 

4 3 



86 

4 



Description 

Decimal adjust AL after addition 



Execute DAA only after executing an ADD instruction that leaves a two-BCD- 
digit byte result in the AL register. The ADD operands should consist of two 
packed BCD digits. The DAA instruction adjusts AL to contain the correct two- 
digit packed decimal result. 



DAS 



Decimal adjust AL after subtraction 



s z 



P c 



Opcode Instruction Clocks 

486 386 286 86 

2F DAS 2 4 3 4 



Description 

Decimal adjust AL after subtraction 



Execute DAS only after a subtraction instruction that leaves a two-BCD-digit 
byte result in the AL register. The operands should consist of two packed BCD 
digits. DAS adjusts AL to contain the correct packed two-digit decimal result. 



DEC 



Decrement by 1 








D 


I T 


S 


ZAP 


C 




* 
Instruction 






* 


* * * 




Opcode 


Clocks 


Description 






486 


386 


286 


86 




FE/1 


DECr/mS 


1/3 


2/6 


2/7 


3/15+EA 


Decrement r/m byte by 1 


FF/1 


DEC r/ml6 


1/3 


2/6 


2/7 


3/15+EA 


Decrement r/m word by 1 




DEC r/rh32 


1/3 


2/6 






Decrement r/m dword by 1 


48+rw 


DEC rl6 


1 


2 


2 


3 


Decrement word register by 1 


48+rw 


DEC r32 


1 


2 






Decrement dword register by 1 
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DEC subtracts 1 from the operand. DEC does not change the carry flag. To 
affect the carry flag, use the SUB instruction with an immediate operand of 1. 



DIV 



Unsigned divide 



p c 



Opcode Instruction Clocks 

486 386 286 86 

F6/6 DIVr/m8 16/16 14/17 14/17 80/86+EA 



Description 



Unsigned divide AX by r/m byte 
(AL=QUO,AH=REM) 

F7/6 DIVr/ml6 24/24 22/25 22/25 144/154+EA Unsigned divide DX:AX by r/m 

word (AX=QUO, DX=REM) 

F7/6 DIVr/m32 40/40 38/41 Unsigned divide EDX:EAX by r/m 
dword (EAX=QUO, EPX=REM) 

DIV performs an unsigned division. The dividend is implicit; only the divisor is 
given as an operand. The remainder is always less than the divisor. The type of 
Qie divisor determines which registers to use as follows: 



Size 


Dividend 


Divisor 


Quotient 


Remainder 


byte 


AX 


r/mS 


AL 


AH 


word 


DX:AX 


r/ml6 


AX 


DX 


dword 


EDX:EAX 


r/m32 


EAX 


EDX (386 only) 



ENTER Mal(e stack frame for procedure parameters 

80186 processors and greater 



Opcode Instruction 




Clocks 


486 


386 286 


C8iw00 Enter imml6,0 


14 


10 11 


C8iw01 Enter iminl6,l 


17 


12 15 



Description 



Make procedure stack frame 

Make stack frame for procedure 
parameters 

CSiwib Enter imml6,itnm8 17+3n 15+4(n-l) 12+4(n-l) Make stack frame for procedure 

parameters 

ENTER creates the stack frame required by most block-structured high-level 
languages. The first operand specifies the number of bytes of dynamic storage 
allocated on the stack for the routine being entered. The second operand gives 
the lexical nesting level (0 to 31) of the routine within the high-level language 
source code. It determines the number of stack frame pointers copied into the 
new stack frame from the preceding frame. BP (or EBP, if the operand-size 
attribute is 32 bits) is the current stack frame pointer. 

If the operand-size attribute is 16 bits, the processor uses BP as the frame 
pointer and SP as the stack pointer. If the operand-size attribute is 32 bits, the 
processor uses EBP for the frame pointer and ESP for the stack pointer. 

If the second operand is 0, ENTER pushes the frame pointer (BP or EBP) onto 
the stack; ENTER then subtracts the first operand from the stack pointer and 
sets the frame pointer to the current stack-pointer value. 

For example, a procedure with 12 bytes of local variables would have an 
ENTER 12,0 insfruction at its enfry point and a LEAVE insfruction before every 
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RET. The 12 local bytes would be addressed as negative offsets from the frame 
pointer. 



HLT 



Halt 



Opcode Instruction 



F4 



HLT 



Clocks 

486 386 286 86 

4 5 2 2 



Description 



Halt 



HLT stops instruction execution and places the x86 in a HALT state. An enabled 
interrupt, NMI, or a reset will resume execution. If an interrupt (including 
NMI) is used to resume execution after HLT, the saved CS:IP (or CSrEIP on an 
386) value points to the instruction following HLT. 



IDIY 



Signed divide 



Opcode Instruction 



486 



Clocks 

386 286 86 



Description 



F6/7 



F7/7 



IDIV r/m8 



19/20 19 17/20 101-112/107-118+EA , Signed divide AX b\ 

r/mbyte(AL=QUO 
AH=REM) 

IDIVr/ml6 27/28 27 25/28 165-184/171-190+EA Signed divide DX:AX 

"Awor ' ' '" ""■ 
=REM) 

F7/7 IDIVr/ni32 43/44 43 



by EA word (AX=QUO, 
DX=F " " 



Signed divide 
EDXrEAX by DWORD 
byte (EAX=QUO, 
EDX=:REM) 



IDIV performs a signed division. The dividend, quotient, and remainder are 
implicitly allocated to fixed registers. Only the divisor is given as an explicit r/ 
m operand. The type of the divisor determines which registers to use as follows: 



Size 


Divisor 


Quotient 


Remainder 


Dividend 


byte 


r/m8 


AL 


AH 


AX 


word 


r/ml6 


AX 


DX 


DX:AX 


dword 


r/m32 


EAX 


EDX 


EDX:EAX (386 only) 



If the resulting quotient is too large to fit in the destination, or if the division 
is 0, an Interrupt is generated. Non-integral quotients are truncated toward 0. 
The remainder has the same sign as the dividend and the absolute value of the 
remainder is always less than the absolute value of the divisor. 
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IMUL 



Signed multiply 








i D I T S Z A P 


C 






* 


? ? ? ? 


* 




Opcode 


Instruction 


Clocks 

486 386 286 


86 


IDpscriplion 


F6/5 


IMULr/m8 


13-18/13-18 9-14/12-17 13/16 80-98/86- 
104+EA 


AX^AL*r/mbyte 


F7/5 


MUL r/ml6 


13-26/13-26 9-22/12-25 21/24 128-154/134, 
160+EA 


DX:AX<-AX*r/m 
word 


¥7/5 


]MULr/in32 


12-42/13-12 9-38/12-41 




EDX:EAX<-EAX*r/m 
dword 


OFAF/i 


■IMULrl6, 
r/ml6 


13-26/13-26 9-22/12-25 




word register <— word 
register *x/m. word 


OFAF/i 


■IMULr32, 
r/m32 


13-42/13-42 9-38/12-41 




dword register 
«-dword register * r/m 
dword 


6B/rib 


IMULrl6, 
r/ml6,iirun8 


13-26/13-26 9-14/12-17 21/24 




word register <— r/inl6 
* sign-exterided 
immediate byte 


6B/rib 


IMULr32, 
r/ m32,imm8 


13-42 9-14/12-17 




dword register <-r/ 
m32 * sign-exterided 
immediate byte 


6B/rib 


IMUL 
rl6,imin8 


13-26 9-14/12-17 21/24 




word register <-word 
register *^sign-exterided 
immediate byte 


65 /rib 


IMUL 
r32,imm8 


13-42 9-14/12-17 




dword register 
<— dword register * sign- 
extended immediate 
byte 


69 /r iw 


IMULrl6, 
r/ml6,iirunl6 


13-26/13-26 9-22/12-25 21/24 




word register <— r/ml6 
immediate word 


69 /rid 


IMULr32, 
r/m32,iinm32 


13-42/13-42 9-38/12-41 




dword register r/m32 * 
immediate dword 


69/riw 


MUL 
rl6,iinml6 


13-26/13-26 9-22/12-25 




word register <— r/ml6 
* immediate word 


69 /rid 


IMUL 
r32,iiiun32 


13-42/ 9-38/12-41 
1342 




dword register 
<-r/m32 * immediate 
dword 



IMUL performs signed miiltiplication. Some forms of the instruction use 
implicit register operands. The operand combinations for all forms of the 
instruction are shown in the "Description" column above. 

IMUL clears the overflow and carry flags imder the following conditions: 



Instruction form 

r/m8 

r/ml6 

r/m32 

rl6,r/ml6 

r32,r/m32 

rl6,r/ml6,imml6 

r32,r/m32,imm32 



Condition for clearing CF and OF 

AL = sign-extend of AL to 16 bits 

AX = sign-extend of AX to 32 bits 

EDX:EAX = sign-extend of E AX to 32 bits 

Result exactly fits within rl6 

Result exactly fits within r32 

Result exactly fits within rl6 

Result exactly fits within r32 
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IN 



Input from port 



ODITSZAPC 



Opcode Instruction Clocks 

486 386 286 86 

E4ib INAL,iimn8 14,pm=8V28**,vm=27 12,pm=6V26** 5 10 

E5ib INAX,imm8 14,pm=8V28**,vm=27 12,pm=6V26** 5 10 

E5ib INEAX,imm8 14,pm=8*/28**,vm=27 12,pm=6V26** 

EC INAL,DX 14,pm=8V28**,vm=27 13,pm=7V27** 5 8 

ED INAX,DX 14,pm=8V28**,vm=27 13,pm=7V27** 5 8 

ED INEAX,DX 14,pm=8V28**,vm=27 13,pm=7V27** 



Input byte from 
imniediate port 
intoAL 

Input word from 
immediate port 
into AX 

Input dword from 
immediate port 
intoEAX 

Input byte from 
port DX into AL 

Input word from 
port DX into AX 

Input dword from 
port DX into EAX 



*IfCPL<IOPL 

**If CPL > lOPL or if in virtual 8086 mode 

IN transfers a data byte or data word from the port numbered by the second 
operand into the register (AL, AX, or EAX) specified by the first operand. 
Access any port from to 65535 by placing the port number in the DX register 
and using an IN instruction with DX as the second parameter. These I/O 
instructions can be shortened by using an 8-bit port I/O in the instruction. The 
upper eight bits of the port address will be when 8-bit port I/O is used. 



INC 



Increment by 1 



Opcode 


Instruction 






Clocks 








486 


386 


286 


86 


FE/0 


INC r/m8 


1/3 


2/6 


2/7 


3/15+EA 


FF/0 


INC r/ml6 


1/3 


2/6 


2/7 


3/15+EA 


FF/6 


. INC r/m32 


1/3 








40+ rw 


INCrl6 


1 


2 


2 


3 


40+ rd 


INCr32 


1 









Description 

Increment r/m byte by 1 
Increment r/m word by 1 
Increment r/m dword by 1 
Increment word register by 1 
Increment dword register by 1 



INC adds 1 to the operand. It does not change the carry flag. To affect the carry 
flag, use the ADD instruction with a second operand of 1. 
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INS 
INSB 
INSW 
INSD 

opcode Instruction 



Input from port to String 
801 86 processors and greater 

I T S Z A P C 



D 



Clocks 

386 



6C 
6D 
6D 
6C 
6D 
6D 



486 

INSr/m8,DX 17,pm=10V32**,vin=30 15,pm=9V29** 5 

INSr/ml6,DX 17,pm=10V32**,vm=30 15,pm=9V29** 5 

INSr/m32,DX 17,pm=10V32**,vin=30 15,pm=9V29** 



286 



INSB 

BMSW 

DSfSD 



17,pm=10V32**,vin=30 15,pm=9V29** 5 
17,pm=10V32**,vm=30 15,pm=9V29** 5 
17,pm=10V32**,vm=30 15,pm=9V29** 



Description 



Input byte from port 
DXintoES:(E)DI 

Input word from port 
DXintoES:(E)DI 

Input dword from port 
DXintoES:(E)DI 

Input byte from port 
DXintoES:(E)DI 

Input word from port 
DXir 



;intoES:(E)DI 

>ut dword fron 
:intoES:(E)DI 



Input dword from port 
DXi 



*IfCPL<IOPL 

**If CPL > lOPL or if in virtual 8086 mode 

INS transfers data from the input port numbered by the DX register to the 
memory byte or word at ES:dest-index. The miemory operand must be 
addressable from ES; no segment override is possible. The destination register 
is DI if the address-size attribute of the instruction is 16 bits, or EDI if the 
address-size attribute is 32 bits. 

INS does not allow the specification of the port number as an immediate value. 
The port must be addressed through the DX register value. Load the correct 
value into DX before executing the INS instruction. 

The destination address is determined by the contents of the destination index 
register. Load the correct index into the destination index register before 
executing INS. 

After the transfer is made, DI or EDI advances automatically. If the direction 
flag is (CLD was executed), DI or EDI increments; if the direction flag is 1 
(STD was executed), DI or EDI decrements. DI increments or decrements by 1 if 
a byte is input, by 2 if a word is input, or by 4 if a doubleword is input. 

INSB, INSW and INSD are synonjnns of the byte, word, and doubleword INS 
instructions. INS can be preceded by the REP prefix for block input of CX bytes 
or words. Refer to the REP instruction for detafls of this operation. 



INT 
INTO 



Call to Interrupt procedure 



ODITSZAPC 




Opcode Instruction 

486 

CC INT3 26 

CC INT3 44 

CC INT3 71 



Clocks 

386 286 

33 23 

pm=59 40 
pm=99 



86 

52 



78 



Description 

Interrupt 3 — ^trap to debugger 
Interrupt 3 — ^protected mode 
Interrupt 3 — ^protected mode 
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Opcode 


Instructior 


I 
486 


Cl( 

386 


)cks 




Description 




286 


86 




CC 


INT3 


82 


pm=119 






Interrupt 3 — from V86 mode to 
PLO 


cc 


INT3 


37+ts 


ts 


167 




Interrupt 3 — ^protected mode 


CDib 


INTiiiunS 


30 


37 


23 


51 


Interrupt numbered by 
unmediate byte 


CDib 


INTimmS 


44 


pm=59 


40 




Interrupt — ^protected mode 


CDib 


INTimmS 


77 


pm=99 


78 




Interrupt — ^protected mode 


CDib 


INTiinmS 


86 


pm=119 






Interrupt — from V86 mode to PLO 


CDib 


INTimmS 


37+ts 


ts 


167 




Interrupt — ^protected mode 


CE 


INTO 


Pass:28, 
Fail:3 


Fail:3, 
pm=3; 
Pass:35 


FaU:3, 
Pass:24 


FaU:4, 
Pass:53 


Interrupt 4 — ^if overflow flag is 1 


CE 


INTO 


46 


pm=59 


41 




Interrupt 4 — ^Protected mode 


CE 


INTO 


73 


pm=99 


79 




Interrupt 4 — ^Protected mode 


CE 


INTO 


84 


pm=119 






Interrupt 4 — from V86 mode to 
PLO 


CE 


INTO 


39+ts 


ts 


168 




Interrupt 4 — ^Protected mode 



*Add one dock for each byte of the next instruction executed (80286 only). 

The INT n instruction generates via software a call to an interrupt handler. The 
immediate operand, from to 255, gives the index nxunber into the interrupt 
descriptor table (IDT) of the interrupt routine to be called. In protected mode, 
the IDT consists of an array of eight-byte descriptors; the descriptor for the 
interrupt invoked must indicate an interrupt, trap, or task gate. In real address 
mode, the IDT is an array of four byte-long pointers. In protected and real 
address modes, the base linear address of the IDT is defined by the contents of 
thelDTR. 

The INTO conditional software iiistruction is identical to the INT n interrupt 
instruction except that the interrupt number is implicitly 4, and the interrupt is 
made if the 86, 286, or 386 overflow flag is set. 

The first 32 interrupts are reserved by Intel for system use. Some of these 
interrupts are use for internally generated exceptions. 

INT n generally behaves like a far call except that the flags register is pushed 
onto the stack before the return address. Interrupt procedures return via the 
IRET instruction, which pops the flags and return address from the stack. 

In real address mode, INT n pushes the flags, CS and the return IP onto the 
stack, in that order, then jumps to the long pointer indexed by the interrupt 
number. 



INVD 



invalidate cache 

i486 processors and greater 



ODITSZAPC 



Opcode 



OF 08 



Instruction 



INVD 



Clock Description 



486 

4 



Invalidate entire cache 
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The internal cache is flushed, and a special-function bus cycle is issued which 
indicates that external caches should also be flushed. Data held in write-back 
external caches is discarded. 

Note: This instruction is implementation-dependent; its function might be 
implemented differently on future Intel processors. 

It is the responsibility of hardware to respond to the external cache flush 
indication. 



INVLPG 



Invalidate TLB entry 

i486 processors and greater 



z 



Opcode Instruction Clock Description 

486 

OF 01/7 INVLPG m 12 for hit Invalidate TLB entry 



The INVLPG instruction is used to invalidate a single entry in the TLB, the 
cache used for table entries. If the TLB contains a valid entry that maps the 
address of the memory operand, that TLB entry is marked invalid. 

In both protected mode and virtual 8086 mode, an invalid opcode is generated 
when used with a register operand. 

Note: This instruction is implementation-dependent; its function might be 
implemented differently on future Intel processors. 



IRET 

IRETD 

IRETW 



Interrupt return 

IRETD 386 processors and greater 



D I T 



Z A P C 



The flags register is popped from stack. 



Opcode 






Clocks 




486 


386 


286 86 


CF 


IRETW 


15 


22,pm=38 


17,pm=31 32 


CF 


IRETW 


36 


pm=82 


55 


CF 


IRETW 


ts+32 


ts 


169 


CF 


IRETD 


15 


22,pm=38 




CF 


IRETD 


36 


pm=82 




CF 


IRETD 


15 


pm=60 




CF 


IRETD 


ts+32 


ts 




CF 


IRET 









Description 



Interrupt rettim (far return and pop 
flags) 

Interrupt return 

Interrupt return 

Interrupt return (far return and pop 
flags) 

Interrupt return to lesser privilege 

Interrupt return to V86 mode 

Interrupt return 

Selects IRETW or IRETD depending 
on segment size of 16 or 32 bits. Only 
works for VERSION T320 or higher. 



*Add one clock, for each byte in the next instruction executed (80286 only). 

In real address mode, IRET pops the instruction pointer, CS, and the flags 
register from the stack and resumes the interrupted routine. 



Chapter 4, Processor instructions 93 



In protected mode, the action of IRET depends on the setting of the nested task 
flag (NT) bit in the flag register. When popping the new flag image from the 
stack, the lOPL bits in the flag register are changed only when CPL equals 0. 

If NT equals 0, IRET returns from an interrupt procedure without a task switch. 
The code returned to must be equally or less privileged than the interrupt 
routine (as indicated by the RPL bits of the CS selector popped from the stack). 
If the destination code is less privileged, IRET also pops the stack pointer and 
SS from the stack. 

If NT equals 1, IRET reverses the operation of a CALL or INT that caused a task 
switch. The updated state of the task executing IRET is saved in its task state 
segment. If the task is re-entered later, the code that follows IRET is executed. 

IRETW pops WORD-style (if you use VERSION T320 or higher). If you're using 
VERSION T310 or less, use IRET; IRETW replaces old functionality of IRET. 



Jcc 



Jump if condition is met 





D 


I T 


S Z 


A 


P C 




Opcode 


Instruction 




Clocks 




Description 






486 


386 


286 


86 




77 cb 


JArelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if above (CF=0 and 
ZF=0) 


73 cb 


JAE rel8 


3/1 


7+m+,3 7,3 


16,4 


Jump short if above or equal 
(CF=0) 


72 cb 


JB rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if below (CF=1) 


76 cb 


JBErelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if below or equal (CF=1 
orZ§=l) 


72 cb 


JC rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if carry (CF=1) 


E3cb 


JCXZrelS 


3/1 


9+m,5 


8,4 


18,6 


Jump short if CX register is 


E3cb 


JECXZrelS 


3/1 


9+m,5 






Jiimp short if ECX register is 


74 cb 


JE relS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if equal (ZF=1) 


74 cb 


JZrelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if 0(ZF=1) 


7Fcb 


JGrelS 


3/1 


7+m;3 


7,3 


16,4 


Jump short if greater (ZF=0 and 


7Dcb 


JGErelB 


3/1 


7+m,3 


7,3 


16,4 


Jump short if greater or equal 
(SF=bF) 


7Ccb 


JLrelB 


3/1 


7+m,3 


7,3 


16,4 


Jump short if less (SFoOF) 


7Ecb 


JLErelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if less or equal (ZF=1 
andBFoOF) 


76 cb 


JNArelB 


3/1 


7+m,3 


7,3 


16,4 


Jimip short if not above (CF=1 or 
ZF=1) 


72 cb 


JNAErelS 


3/1 


7+m,3 


7,3 


16,4 


Jimip short if not above or equal 
(CF=1) 


73 cb 


JNBrelS 


3/1 


7+m,3 


7,3 


16,4 


Jimip short if not below (CF=0) 


77 cb 


JNBErelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not below or equal 
(CF=OandZF=0) 


73 cb 


JNCrelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not carry (CF=0) 


75 cb 


JNErelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not equal (ZF=0) 


7Ecb 


JNGrelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not greater (ZF=1 or 
SF<>OF) 


7Ccb 


JNGE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jimip short if not greater or equal 
(SF<>OF) 


7Dcb 


JNLrelS 


3/1 


7+m,3 


T^ 


16,4 


Jvimp short if not less (SF=OF) 
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opcode 


Instruction 




Clo 


cks 




Description 






486 


386 


286 


86 




TFcb 


JNLE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jximp short if not less or equal 
(ZF=0andSF=OF) 


71 cb 


JNOrel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not overflow (OF=0) 


TBcb 


JNP rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not parity (PF=0) 


79 cb 


JNSrel8 


3/1 


7+m,3 


7,3 


16,4 


]\mvp short if not sign (SF=0) 


75 cb 


JNZrel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not zero (ZF=0) 


70 cb 


JO rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if overflow (OF=l) 


7Acb 


JFrel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if parity (PF=1) 


7Acb 


JFE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if parity even (PF=1) 


7Bcb 


JPOrel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if parity odd (FF=0) 


78 cb 


JSrel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if sign (SF=1) 


74 cb 


JZrelS 


3/1 


7+m,3 


7,3 


16,4 


Jump short of zero (ZF=1) 


0F87cw/cd 


JA rell6/32 


3/1 


7+m,3 






Jump near if above (CF=0 and 
ZF=D) 


OF 83 cw/cd 


JAE rell6/32 


3/1 


7+m,3 






Jump near if above or equal (CF=0) 


OF 82 cw/cd 


JB rell6/32 


3/1 


7+m,3 






Jump near if below (CF=1) 


OF 86 cw/cd 


JBE rell6/32 


3/1 


7+m,3 






Jump near if below or equal 
(CF=lorZF=l) 


OF 82 cw/cd 


JC rell6/32 


3/1 


7+in,3 






Jump near if carry (CF=1) 


OF 84 cw/cd 


JE rell6/32 


3/1 


7+m,3 






Jump near if equal (ZF=1) 


OF M cw/cd 


JZ rell6/32 


3/1 


7+m,3 






Jump near if 0(ZF=1) 


OF 8F cw/cd 


JG rell6/32 


3/1 


7+m,3 






Jump near if greater (ZF=0 and 
SF=OF) 


OF 8D cw/cd 


JGE rell6/32 


3/1 


7+in,3 






Jump near if greater or equal 
(SF=bF) 


OF 8C cw/cd 


JL rell6/32 


3/1 


7+m,3 






Jump near if less (SFoOF) 


OF 8E cw/cd 


JLErell6/32 


3/1 


7+m,3 






Jimip near if less or equal(ZF=l 
andSFoOF) 


OF 86cw/cd 


JNArell6/32 


3/1 


7+m,3 






Jump near if not above (CF=1 or 
ZF=i) 


OF 82 cw/cd 


JNAE rell6/32 


3/1 


7+m,3 






Jtunp near if not above or equal 
(CF=1) 


OF 83 cw/cd 


JNB rell6/32 


3/1 


7+m,3 






Jump near if not below (CF=0) 


OF 87 cw/cd 


JNBErell6/32 


3/1 


7+m,3 






Jump near if not below or equal 
(CF=OandZF=0 


OF 83 cw/cd 


JNC rell6/32 


3/1 


7+m,3 






Jump near if not carry and ZF=0) 


OF 85 cw/cd 


JNE rell6/32 


3/1 


7+m,3 






Jump near if not equal (ZF=0) 


OF 8E cw/cd 


JNG rell6/32 


3/1 


7+m,3 






Jump near if not greater (ZF=1 or 
SFoOF) 


OF 8C cw/cd 


JNGErell6/32 


3/1 


7+m,3 






Jump near if not greater or equal 
(SFoOF) 


OF 8D cw/cd 


JNLrell6/32 


3/1 


7+m,3 






Jump near if not less (SF=OF) 


OF 8F cw/cd 


JNLErell6/32 


3/1 


7+m,3 






Jvunp near if not less or equal 
(ZF=0andSF=OF) 


OF 81 cw/cd 


JNOrell6/32 


3/1 


7+m,3 






Jump near if not overflow (OF=0) 


OF 8B cw/cd 


JNPrell6/32 


3/1 


7+m,3 






Jump near if not parity (PF=0) 


OF 89 cw/cd 


JNSrell6/32 


3/1 


7+m,3 






Jump near if not sign (SF=0) 


OF 85 cw/cd 


JNZrell6/32 


3/1 


7+m,3 






Jtimp near if not zero (ZF=0) 


OF 80 cw/cd 


JOrell6/32 


3/1 


7+m,3 






Jump near if overflow (OF=l) 


OF 8A cw/cd 


JPrell6/32 


3/1 


7+m,3 






Jump near if parity (PF=1) 


OF 8A cw/cd 


JFErell6/32 


3/1 


7+m,3 






Jump near if parity even (FF=1) 
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Opcode 


Instruction 




Cloi 

386 


:ks 

286 


86 


Description 






486 




OF 8B cw/cd 


JPOrell6/32 


3/1 


7+m3 






Jiimp near if parity odd (PF=0) 


0F88cw/cd 


JSrell6/32 


3/1 


Z+m,3 






Jump neai if sign (SF=1) 


OF 84 cw/cd 


JZrell6/32 


3/1 


7+m,3 






Jump near if zero (ZF=1) 



*When a jump is taken, add one dock for every byte of the next instruction executed (80286 
only). 

Note: The first clock count is for the true condition (branch taken); the second 
clock count is for the false condition (branch not taken). rell6/32 indicates that 
these instructions map to two; one with a 16-bit relative displacement, the other 
with a 32-bit relative displacement, depending on the operand-size attribute of 
the instruction. 

Conditional jumps (except JCXZ/JECXZ) test the flags which have been set by a 
previous instruction. The conditions for each mnemonic are given in 
parentheses after each description above. The terms "less" and "greater" are 
used for comparisons of signed integers; "above" and "below" are used for 
unsigned integers. 

If the given condition is true, a jump is made to the location provided as the 
operand. Instruction coding is most efficient when the target for the conditional 
jump is in the current code segment and within -128 to + 127 bytes of the next 
instruction's first byte. The jump can also target -32768 through +32767 
(segment size attribute 16) or -2 to the 31st power +2 to the 31st power -1 
(segment size attribute 32) relative to the next instruction's first byte. When the 
target for the conditional jump is in a different segment, use the opposite case of 
the jump instruction (that is, JE and JNE), and then access the target with an 
unconditional far jum^p to the other segment. For example, you cannot code 

JZ FARLABEL; 

You must instead code 

JNZ BEYOND; 
JMP FARLABEL; 
BEYOND: 

Because there can be several ways to interpret a particular state of the flags, 
TASM provides more than one mnemonic for most of the conditional jump 
opcodes. For example, if you compared two characters in AX and want to jump 
if they are equal, use JE; or, if you ANDed AX with a bit field mask and only 
want to jump if the result is 0, use JZ, a synonym for JE. 

JCXZ/JECXZ differs from other conditional jumps because it tests the contents 
of the CX or ECX register for 0, not the flags. JCXZ/JECXZ is useful at the 
beginning of a conditional loop that terminates with a conditional loop 
instiuction (such as LOOPNE TARGET LABEL). The JCXZ/JECXZ prevents 
entering the loop with CX or ECX equal to zero, which would cause the loop to 
execute 64K or 32G times instead of zero times. 
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JMP 



Jump 



ODITSZAPC 

All if a task switch takes place; none if no task switch occurs. 



Opcode 


Instruction 




Clocks 




Description 






486 


386 286 


86 




EBcb 


JMP rel8 


3 


7+m 7 


15 


Jump short 


E9cw 


JMP rell6 


3 


7+m 7 


15 


Jump riear 


FF/4 


JMP r/ml6 


5/5 


7+in/lO+m 7/11 


11/18+EA Jump near 
indirect 


EAcd 


JMPptrl6:16 


17pm=19 


12+m, pm=27+m ll,pm=23 


15 


Jump 

intersegment, 
4-byte immediate 
address 


EAcd 


JMPptrl6:16 


32 


pm=45+m 38 




Jump to call gate, 
same privilege 


EAcd 


JMPptrl6:16 


42+ts 


ts 175 




Jump via task 
state segment 


EAcd 


JMPptrl6:16 


43+ts 


ts 180 


24+EA 


Jtunp via task gate 


FF/5 


JMPml6:16 


13,pm=18 


43+m,pm=31+m 15,pm=26 




Jump r/ml6:16 
indirect and 
intersegment 


FF/5 


JMPml6:16 


31 


pm=49+m 41 




Jump to call gate, 
same privilege 


FF/5 


JMPml6:16 


41+ts 


5+ts 178 




Jump via task 
state segment 


FF/5 


JMPml6:16 


42+ts 


5+ts 183 




Jump via task gate 


E9cd 


JMPrel32 


3 


7+m 




Jump near 


FF/4 


JMPr/m32 


5/5 


7+m,10+m 




Jiraip near 


EAcp 


JMPptrl6:32 


13,pm=18 


12+m, pm=27+m 




Jump 

intersegment, 
6-byte immediate 
address 


EAcp 


JMPptrl6;32 


31 


pm=45+m 




Jump to call gate, 
same privilege 


EAcp 


JMPptrl6:32 


42+ts 


ts 




Jump via task 
state segment 


EAcp 


JMPptrl6:32 


43+ts 


ts 




Jimip via task gate 


FF/5 


JMPml6:32 


13,pm=18 


43+m, pm=31+m 




Jump 

intersegment 
address at r/m 
dword 


FF/5 


JMPml6:32 


31 


pm=49+m 




Jump to call gate, 
same privilege 


FF/5 


JMPml6:32 


41+tslO 


5 + ts 




Jump via task 
state segment 


FF/5 


JMPml6:32 


42+ts 


5 + ts • 




Jiunp via task gate 



*Add one clock for every byte of the next instruction executed (80286 only). 

The JMP instruction transfers control to a different point in the instruction 
stream without recording return information. 

The action of the various forms of the instruction are shown below. 

Jumps with destinations of type r/ml6, r/m32, rell6, and rel32 are near jumps 
and do not involve changing the segment register value. 
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The JMP rell6 and JMP rel32 forms of the instruction add an offset to the 
address of the instruction following the JMP to determine the destination. The 
rell6 form is used when the instruction's operand-size attribute is 16 bits 
(segment size attribute 16 only); rel32 is used when the operand-size attribute is 
32 bits (segment size attribute 32 only). The result is stored in the 32-bit EIP 
register. With rell6, the upper 16 bits of EIP are cleared, which results in an 
offset whose value does not exceed 16 bits. 

JMP r/ml6 and JMP r/m32 specifies a register or memory location from which 
the absolute offset from the procedure is fetched. The offset fetched from r/m is 
32 bits for an operand-size attribute of 32 bits (r/m32), or 16 bits for an operand- 
size attribute of 16 bits (r/ml6). 

The JMP ptrl6:16 and ptrl6:32 forms of the instruction use a four-byte or six- 
byte operand as a long pointer to the destination. The JMP ml6:16 and ml6:32 
forms fetch the long pointer from the memory location specified (indirection). 
In real address mode or virtual 8086 mode, the long pointer provides 16 bits for 
the CS register and 16 or 32 bits for the EIP register (depending on the operand- 
size attribute). In protected mode, both long pointer forms consult the access 
rights (AR) byte in the descriptor indexed by the selector part of the long 
pointer. Depending on the value of the AR byte, the jump will perform one of 
the following types of control transfers: 

• a jump to a code segment at the same privilege level 

• a task switch 

LAHF Loads flags into AH register 



Opcode Instruction Clocks Description 

486 386 286 86 

9F LAHF 3 2 2 4 Load: AH = flags SF ZF xx AF xx PF xx CF 

LAHF transfers the low byte of the flags word to AH. The bits, from MSB to 
LSB, are sign, zero, indeterminate, auxiliary carry, indeterminate, parity, 
indeterminate, and carry. 

LAR Load access rights byte 

80286 and greater protected mode only 



Opcode Instruction Clocks Description 

486 386 286 

0F02/r LARrl6,r/ml6 11/11 pm=15/16 14/16 rl64-r/ml6 masked by FFOO 

0F02/r LARr32,r/m32 11/11 pm=15/16 r32^r/m32 masked by OOFxFFOO 

The LAR instruction stores a marked form of the second doubleword of the 
descriptor for the source selector if the selector is visible at the CPL (modified 
by the selector's RPL) and is a valid descriptor type. The destination register is 
loaded with the high-order doubleword of the descriptor masked by OOFxFFOO, 
and ZF is set to 1 . The x indicates that the four bits corresponding to the upper 
four bits of the limit are undefined in the value loaded by LAR. If the selector is 
invisible or of the wrong type, ZF is cleared. 
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If the 32-bit operand size is specified, the entire 32-bit value is loaded into the 
32-bit destination register. If the 16-bit operand size is specified, the lower 16- 
bits of this value are stored in the 16-bit destination register. 

All code and data segment descriptors are valid for LAR. (See your Intel 
manual for valid segment and gate descriptor types for LAR.) 

LEA Load effective address offset 



Opcode Instmctioii Clocks Description 

486 386 286 86 

8D/r LEArl6,m 12 3 2+EA Store effective address for m in register rl6 

SD/r LEAr32,m 1 2 Store effective address for m in register r32 

8D/r LEArl6,m 1 2 Store effective address for m in register rl6 

SD/r LEAr32,m 1 2 Store effective address for m in register r32 

LEA calculates the effective address (offset part) and stores it in the specified 
register. The operand-size attribute of the instruction is determined by the 
chosen register. The address-size attribute is determined by the USE attribute of 
the segment containing the second operand. The address-size and operand-size 
attributes affect the action performed by LEA, as follows: 

Operand size Address size Action performed 

16 16 16-bit effective address is calculated and 

stored in requested 16-bit register 
destination. 

16 32 32-bit effective address is calculated. The 

lower 16 bits of the address are stored in the 
requested 16-bit register destination. 

32 16 16-bit effective address is calculated. The 

16-bit address is zero-extended and stored in 
the requested 32-bit register destination. 

32 32 32-bit effective address is calculated and 

stored in the requested 32-bit register 
destination. 

LEAVE High-level procedure exit 

80186 processors and greater 



Opcode Instruction Clocks Description 

486 386 286 

C9 LEAVE 5 4 5 SetSPtoBP 

C9 LEAVE 5 4 Set ESP to EBP 

LEAVE reverses the actions of the ENTER instruction. By copying the frame 
pointer to the stack pointer, LEAVE releases the stack space used by a 
procedure for its local variables. The old frame pointer is popped into BP or 
EBP, restoring the caller's frame. A subsequent RET nn instruction removes any 
arguments pushed onto the stack of the exiting procedure. 
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LGDT/LIDT Load global/interrupt descriptor table register 
80286 and greater protected mode only 



Opcode Instruction Clocks Description 

486 386 286 

OF 01 /2 LGDT ml6&32 11 11 11 Load m into global descriptor table register 

OF 01/3 LIDTml6&32 11 11 12 Load m into interrupt descriptor table register 

The LGDT and LIDT instructions load a linear base address and limit value 
from a six-byte data operand in memory into the GDTR or IDTR, respectively. 
If a 16-bit operand is used with LGDT or LIDT, the register is loaded with a 16- 
bit limit and a 24-bit base, and the high-order 8 bits of the 6-byte data operand 
are not used. If a 32-bit operand is used, a 16-bit limit and a 32-bit base is 
loaded; the high-order 8 bits of the 6-byte operand are used as high-order base 
address bits. 

The SGDT and SIDT instructions always store into all 48 bits of the 6-byte data 
operand. With the 80286, the upper 8 bits are xmdefined after SGDT or SIDT is 
executed. With the 386, the upper 8 bits are written with the high-order 8 
address bits, for both a 16-bit operand and a 32-bit operand. If LGDT or LIDT is 
used with a 16-bit operand to load the register stored by SGDT or SIDT, the 
upper 8 bits are stored as zeros. 

LGDT and LIDT appear in operating system software; they are not used in 
application programs. They are the only instructions that directly load a linear 
address (i.e., not a segment relative address) in 386 protected mode. 

LGS Load full pointer 

LSS LGS/LSS/LFS 386 process ors and greater 

LPS ODITSZAPC 

IDS 
LES 

Opcode Instruction Clocks Description 

486 386 286 86 

C5/r LDSrl6,ml6:16 6/12 7,pm=22 7,pm=21 16+EA Load DS:rl6 with pointer 

from memory 

C5/r LDS r32,ml6:32 6/12 7,pm=22 Load DS:r32 with pointer 

from memory 

0FB2/r LSS rl6,ml6:16 6/12 7,pm=22 Load SS:rl6 with pointer from 

memory 

0FB2/r LSS r32,ml6:32 6/12 7,pm=22 Load SS:r32 with pointer from 

memory 

C4/r LES rl6,ml6:16 6/12 7,pm=22 7,pm=21 16+EA Load ES:rl6 with pointer 

from memory 

C4/r LES r32,ml6:32 6/12 7,pm=22 Load ES:r32 with pointer 

from memory 

0FB4/r LFSrl6,ml6:16 6/12 7,pm=25 Load FS:rl6 with pointer 

from memory 

0FB4/r LFS r32,ml6:32 6/12 7,pm=25 Load FS:r32 with pointer 

. from memory 
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Opcode Instruction Clocks Description 

486 386 286 86 

0FB5/r LGS rl6,ml6:16 6/12 7,pm=25 Load GS:rl6 with pointer 

from memory 

0FB5/r LGS r32,ml6:32 6/12 7,pm=25 Load GS:r32 with pointer 

from memory 

These instructions read a full pointer from memory and store it in the selected 
segment register: register pair. The full pointer loads 16 bits into the segment 
register SS, DS, ES, FS, or GS. The other register loads 32 bits if the operand-size 
attribute is 32 bits, or loads 16 bits if the operand-size attribute is 16 bits. The 
other 16- or 32-bit register to be loaded is determined by the rl6 or r32 register 
operand specified. 

When an assignment is made to one of the segm.ent registers, the descriptor is 
also loaded into the segment register. The data for the register is obtained from 
the descriptor table entry for the selector given. 

A null selector (values 0000-0003) can be loaded into DS, ES, FS, or GS registers 
without causing a protection exception. (Any subsequent reference to a 
segment whose corresponding segment register is loaded with a null selector to 
address memory causes a #GP(0) exception. No memory reference to the 
segment occurs.) 

LLDT Load local descriptor table register 

80286 and greater protected mode only 



Opcode Instruction Clocks Description 

486 386 286 

OF 00/2 LLDTr/ml6 11/1120 17/19 Load selector r/ml6 into LDTR 

LLDT loads the local descriptor table register (LDTR). The word operand 
(memory or register) to LLDT should contain a selector to the global descriptor 
table (GDT). The GDT entry should be a local descriptor table. If so, then the 
LDTR is loaded from the entry. The descriptor registers DS, ES, SS, FS, GS, and 
CS are not affected. The LDT field in the task state segment does not change. 

The selector operand can be 0; if so, the LDTR is marked invalid. All descriptor 
references (except by the LAR, VERR, VERW or LSL instructions) cause a #GP 
fault. 

LLDT is used in operating system software; it is not used in application 
programs. 

LMSW Load machine status word 

80286 and greater protected mode only 



opcode Instruction Clocks Description 

486 386 286 

OF 01/6 LMSWr/ml6 13/13 10/13 3/6 Load r/m 16 into machine status word 
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LMSW loads the machine status word (part of CRO) from the source operand. 
This instruction can be used to switch to protected mode; if so, it must be 
followed by an intrasegment jump to flush the instruction queue. LMSW will 
not switch back to real address mode. 

LMSW is used only in operating system software. It is not used in application 
programs. 

LOCK Assert LOCK# signal prefix 





D 


ITS 


z 


A P C 


Opcode Instruclinn 




Clocks 


86 


Description 




486 


386 286 




FO LOCK 


1 





2 


Assert LOCK# signal for the next instruction 



The LOCK prefix causes the LOCK# signal of the CPU to be asserted during 
execution of the instruction that follows it. In a multiprocessor environment, 
this signal can be used to ensure that the CPU has exclusive use of any shared 
memory while LOCK# is asserted. The read-modify-write sequence typically 
used to implement test-and-set on the 386 is the BTS instruction. 

On the 386 and i486, the LOCK prefix functions only with the following 
instructions: 

BT, BTS, BTR, BTC mem,reg/imm 

XCHG reg, mem 

XCHG mem, reg 

ADD, OR, ADC, SBB, mem, reg/imm 

AND,SUB,XOR 

NOT, NEC, INC, DEC mem 

An undefined opcode trap will be generated if a LOCK prefix is used with any 
instruction not listed above. 

XCHG always asserts LOCK # regardless of the presence or absence of the 
LOCK prefix. 

The integrity of the LOCK is not affected by the alignment of the memory field. 
Memory locking is observed for arbitrarily misaligned fields. 

Locked access is not assured if another CPU processor is executing an 
instruction concurrently that has one of the following characteristics: 

• Is not preceded by a LOCK prefix. 

• Is not one of the instructions in the preceding list. 

• Specifies a memory operand that does not exactly overlap the destination 
operand. Locking is not guaranteed for partial overlap, even if one memory 
operand is wholly contained within another. 
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LODS Load string operand 

LODSB LODSD 386 processors and greater 



LODSW 


D 


I 


T S 


Z 


A P C 


LODSD 












opcode Instruction 




Clocks 




Description 




486 


386 


286 


86 




AC LODSmlS 


5 


5 


5 


12 


Load byte [(E)SI] into AL 


AD LODSml6 


5 


5 


5 


12 


Load word [(E)SI] into AX 


AD LODS m32 


5 


5 






Load dword [(E)SI] into EAX 


AC LODSB 


5 


5 


5 


12 


Load byte DS:[(E)SI] into AL 


AD LODSW 


5 


5 


5 


12 


Load word DS:[(E)SI] into AX 


AD LODSD5 


5 








Load dword DS:[(E)SI] into EAX 



LODS loads the AL, AX, or EAX register with the memory byte, word, or 
doubleword at the location pointed to by the source-index register. After the 
transfer is made, the source-index register is automatically advanced. If the 
direction flag is (CLD was executed), the source index increments; if the 
direction flag is 1 (STD was executed), it decrements. The increment or 
decrement is 1 if a byte is loaded, 2 if a word is loaded, or 4 if a doubleword is 
loaded. 

If the address-size attribute for this instruction is 16 bits, SI is used for the 
source-index register; otherwise the address-size attribute is 32 bits, and the ESI 
register is used. The address of the source data is determined solely by the 
contents of ESI /SI. Load the correct index value into SI before executing the 
LODS instruction. LODSB, LODSW, LODSD are synonyms for the byte, word, 
and doubleword LODS instructions. 

LODS can be preceded by the REP prefix; however, LODS is used more 
typically within a LOOP construct, because further processing of the data 
moved into EAX, AX, or AL is usually necessary. 

LOOP Loop control with CX counter 

LOOPcond Loop control witli CX/ECX counter 
386 processors and greater 



Opcode Instruction 



E2cb 
Elcb 
Elcb 
EOcb 
EOcb 



LOOPrelS 
LOOPErelS 
LOOPZrelS 
LOOPNE rel8 
LOOPNZ rel8 9,6 



Clocks Description 

486 386 286 86 

2,6 ll+m 8,noj=4 17,noj=5 DEC Coxmt; jump ! 

Count 

DEC Count; jump short if 



) short if 



L.oimt u 

9,6 ll+m 8,noj=4 18,noj=6 DEC Coimt; jump s 

Count Oand;ZF=l 

9,6 ll+m 8,noj=4 18,noj=6 DEC Count; jump short if 

Coimt Oand:ZF=l 

9,6 ll+m 8,noj=4 19,noj=5 DEC Count; jump short if 

Count and ZF=0 

9,6 ll+m 8,noj=4 19,noj=5 DEC Coimt;jump short if 

Count OandZF=0 

LOOP decrements the count register without changing any of the flags. 
Conditions are then checked for the form of LOOP being used. If the conditions 
are met, a short jump is made to the label given by the operand to LOOP. If the 
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address-size attribute is 16 bits, the CX register is used as the count register; 
otherwise the ECX register is used (386 ordy). The operand of LOOP must be in 
the range from 128 (decimal) bytes before the instruction to 127 bytes ahead of 
the instruction. 

The LOOP instructioiis provide iteration control and combine loop index 
management with conditional branching. Use the LOOP instruction by loading 
an unsigned iteration count into the count register, then code the LOOP at the 
end of a series of instructions to be iterated, llie destination of LOOP is a label 
that points to the beginning of the iteration. 



LSL 



Load segment limit 

80286 and greater protected mode only 



Opcode Instruction 



486 



Clocks 
386 286 



Description 



0F03/r LSL rl6,r/ml6 10/10 pm=20/21 14/16 Load: rl6<-segment limit, selector 

r/ml6 (byte granular) 

0F03/r LSLr32,r/m32 10/10 pm=20/21 Load: r32<-segment limit, segment 

limit, selector r/m32 (byte granular) 

0F03/r LSLrl6,r/ml6 10/10 pm=25/26 14/16 Load: rl6<-segment limit, segment 

limit, selector r/ml6 (page granular) 

0F03/r LSLr32,r/m32 10/10 pm=26/26 Load: r32<-segment limit selector 

r/m32 (page granular) 

The LSL instruction loads a register with an unscrambled segment limit, and 
sets ZF to 1, provided that the source selector is visible at the CPL weakened by 
RPL, and that the descriptor is a type accepted by LSL. Otherwise, ZF is cleared 
to 0, and the destination register is unchanged. The segment limit is loaded as a 
byte granular value. If the descriptor has a page granular segment limit, LSL 
will translate it to a byte limit before loading it in the destination register (shift 
left 12 the 20-bit "raw" limit from descriptor, then OR with OOOOOFFFH). 

The 32-bit forms of this iiistruction store the 32-bit byte granular limit in the 
16-bit destination register. 

Code and data segment descriptors are valid for LSL. 



LTR 



Load task register 

80286 and greater protected mode only 








D I 


T S Z A 


P C 




Opcode 


Instruction 




Clocks 




Description 






486 


386 


286 




OF 00/3 


LTRr/ml6 


20/20 


pm=23/27 


17/19 


Load EA word into task register 



LTR loads the task register from the source register or memory location 
specified by the operand. The loaded task state segment is marked busy. A task 
switch does not occur. 

LTR is used only in operating system software; it is not used in application 
programs. 
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MOV 



Move data 

D I T 



Opcode Instruction 

486 386 

88 /r MOVr/m8,r8 1 2/2 

89 /r MOVr/ml6,rl6 1 2/2 

89 /r MOVr/m32,r32 1 2/2 

8A/r MOVr8,r/m8 1 2/4 

8B/r MOVrl6,r/ml6 1 2/4 

8B/r MOVr32,r/m32 1 2/4 



Z A P C 

Clocks 

286 

2/3 

2/3 



2/5 



2/5 



8C/r MOVr/ml6,Sreg 3/3 2/2 2/3 

8D/r MOVSreg,r/ml6 3/9 2/5,pm=18/19 2/5,pm=17/19 

AO MOVAL,moffs8 14 5 

Al MOVAX,moffsl6 14 5 



Al 


MOV 
EAX,moffe32 




4 




A2 


MOVmoffs8,AL 




4 


3 


A3 


MOVmoffsl6,AX 




2 


3 


A3 


MOV 
moffs32,EAX 




2 




BO+rb 


MOV reg8,imm8 




2 


2 


B8+rw 


MOV 
regl6,imml6 




2 


2 



B8+rd MOV 1 2 

reg32,imin32 



C6 MOVr/m8,imm8 1 2/2 



2/3 



Description 
86 

2/9+EA Move byte 
register into 
r/mbyte 

2/9+EA Move word 
register into 
r/m word 

Move dword 
register to r/m 
dword 

2/8+EA Move r/m 

byte into byte 
register 

2/8+EA Move r/m 
word into 
word register 

Move r/m 
dword into 
dword register 

2/9+EA Move segment 
register to r/m 
register 

2/8+EA Move r/m 
word to 
segment 
register 

10 Move byte at 

(seg:offset) to 

10 Move word at 

(seg:offset) to 

Move dword 

at(seg:offset)to 

EAX 

10 Move AL to 

(segroffset) 

10 Move AX to 

(seg:offset) 

Move EAX to 
(segroffset) 

4 Move 

immediate byte 
to register 

4 Move 

immediate 
word to 
register 

Move 
immediate 
dword to 
register 

4/10+EA Move 

iirunediatebyte 
tor/mbyte 
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Opcode 


Instruction 






Clocks 




Description 






486 


386 


286 


86 




C7 


MOVr/ 
ral6,iinml6 


1 


2/2 


2/3 


4/10+EA 


Move 
immediate 
word to r/m 
word 


C7 


MOVr/ 
m32,imm32 


1 


111 






Move 
immediate 
dword to r/m 
dword 



MOV copies the second operand to the first operand. 

If the destination operand is a segment register (DS, ES, SS, etc.), then data from 
a descriptor is also loaded into the register. The data for the register is obtained 
from the descriptor table entry for the selector given. A nuU selector (values 
0000-0003) can be loaded into DS and ES registers without causing an 
exception; however/ use of DS or ES causes a #GP(0), and no memory reference 
occurs. 

A MOV into SS inhibits all interrupts until after the execution of the next 
instruction (which is presumably a MOV into eSP). 



MOV 



Move to/from special registers 
386 processors and greater 



Opcode Instruction Clocks 

486 386 

0F22/r MOV,CR0,r32 16 

0F20/r MOVr32,CR0/CR2/CR3/CR4 4 6 

0F22/r MOVCR0/CR2/CR3/CR4,r32 4 10/4/5 

0F21/r MOVr32,DR0-3 10 22 

0F21/r MOVr32,DR6/DR7 10 14 

0F23/r MOVDR0-3,r32 11 22 

0F23/r MOVDR6/DR7,r32 11 16 

0F24/r MOVr32,TR6/TR7 4 12 

0F26/r MOVTR6/TR7^32 4 12 

0F24/r MOVr32,TR3 3 



Description 

Move (register) to (control register) 
Move (control register) to (register) 

Move (debug register) to (register) 
Move (debug register) to (register) 
Move (register) to (debug register) 
Move (register) to (debug register) 
Move (test register) to (register) 
Move (register) to (test register) 
Move (registers) to (test register3) 



These forms of MOV store or load the following special registers in or from a 
general-purpose register: 

• Control Registers CRO, CR2, CR3, and CR4 (CR4 only on Pentium) 

• Debug Registers DRO,DRl,DR2,DR3,DR6, and DR7 

• Test Registers TR3, TR4, TR5, TR6, and TR7 (not valid on Pentium) 

32-bit operands are always used with these instructions, regardless of the 
operand-size attribute. 
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MOVS 
MOVSB 
MOVSW 
MOVSD 

opcode Instruction 



Move data from string to string 
MOVSD 386 processors and greater 



A4 
A5 
A5 
A4 
A5 
A5 



MOVSm8,m8 

MOVSml6,ml6 

MOVm32,m32 

MOVSB 

MOVSW 

MOVSD 



486 

7 
7 
7 
7 
7 
7 



Clocks 

386 286 



86 

18 
18 

18 
18 



Description 

Move byte [(E)SI] to ES:[(E)DI] 
Move word [(E)SI] to ES:[(E)DI] 
Move dword [(E)SI] to ES:[(E)DI] 
Move byte DS:[(E)SI] to ES:[(E)DI] 
Move word DS:[(E)SI] to ES:[(E)DI] 
Move dword DS:[(E)SI] to ES:[(E)DI] 



MOVS copies the byte or word at [(E)SI] to the byte or word at ES: [(E)DI]. The 
destination operand must be addressable from the ES register; no segment 
override is possible for the destination. A segment override can be used for the 
source operand; the default is DS. 

The addresses of the source and destination are determined solely by the 
contents of (E)SI and (E)DI. Load the correct index values into (E)SI and (E)DI 
before executing the MOVS instiuction. MOVSB, MOVSW, and MOVSD are 
synonyms for the byte, word, and doubleword MOVS instiuctions. 

After the data is moved, both (E)S1 and (E)DI are advanced automatically. If the 
direction flag is (CLD was executed), the registers are incremented; if the 
direction flag is 1 (STD was executed), the registers are decremented. The 
registers are incremented or decremented by 1 if a byte was moved, 2 if a word 
was moved, or 4 if a doubleword was moved. 

MOVS can be preceded by the REP prefix for block movement of CX bytes or 
words. Refer to the REP instiuction for details of this operation. 

MOYSX Move witli sign-extend 

386 processors and greater 





D I 


T S Z 
Clocks 


A P C 


Opcode 


Instruction 


Description 






486 


386 




OF BE A 


MOVSXrl6,r/m8 


3/3 


3/6 


Move byte to word with sign extend 


OFBE/r 


MOVSXr32,r/m8 


3/3 


3/6 


Move byte to dword 


OF BE /r 


MOVSXr32,r/ml6 


3/3 


3/6 


Move word to dword 



MOVSX reads the contents of the effective address or register as a byte or a 
word, sign-extends the value to the operand-size attiibute of the instiuction 
(16 or 32 bits), and stores the result in the destination register. 
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MOVZX Move with zero-extend 

386 processors and greater 



Opcode Instruction Clocks Description 

486 386 

0FB6/r MOVZX rl6;r/m8 3/3 3/6 Move byte to word with zero extend 

0FB6/r MOVZX r32,r/m8 3/3 3/6 Move byte to dword 

0FB7/r MOVZX r32,r/ml6 3/3 3/6 Move word to dword 

MOVZX reads the contents of the effective address or register as a byte or a 
word, zero extends the value to the operand-size attribute of the instruction 
(16 or 32 bits), and stores the result in the destination register. 



MUL 



Unsigned multiplication of AL or AX 



D 



Z A 



Opcode Instruction 



486 



386 



Clocks 
286 86 



Description 



F6/4 



MULr/mS 13/18, 9-14/12-17 13/16 70-77/ 76-83+EA 
13/18 



Unsigned multiply 

(AXr(AL8r/m 

byte) 

F7/4 MULr/ml6 13/26, 9-22/12-25 21/24 118-113/124-139+EA PX:AX[AX 
13/26 *r/m word) 

F7/4 MULr/m32 13/42, 9-38/12-41 Unsigned multiply 

13/42 (EDX:EAX[EAX 

* r/m dword) 

MUL performs unsigned multiplication. Its actions depend on the size of its 
operand, as follows: 

• A byte operand is multiplied by AL; the result is left in AX. The carry and 
overflow flags are set to if AH is 0; otherwise, they are set to 1. 

• A word operand is multiplied by AX; the result is left in DX: AX. DX 
contains the high-order 16 bits of the product. The carry and overflow flags 
are set to if DX is 0; otherwise, they are set to 1. 

• A doubleword operand is multiplied by EAX and the result is left in 
EDX:EAX. EDX contains the high-order 32 bits of the product. The carry and 
overflow flags are set to if EDX is 0; otherwise, they are set to 1 (386 only). 



NEG 



Two's complement negation 



A P 



Opcode Instruction 

486 

F6/3 NEGr/m8 1/3 
F7/3 NEGr/ml6 1/3 
F7/3 NEGr/m32 1/3 



Clocks Description 

386 286 86 

2/6 2/7 3/16+EA Two's complement negate r/m b5^e 

2/6 2/7 3/16+EA Two's complement negate r/m word 
2/6 Two's complement negate r/m dword 
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NEG replaces the value of a register or memory operand with its two's 
complement. The operand is subtracted from zero, and the result is placed in 
the operand. 

The carry flag is set to 1, tmless the operand is zero, in which case the carry flag 
is cleared to 0. 



NOP 



No operation 



opcode Instruction Clocks Description 

486 386 286 86 

90 NOP 1 3 3 3 No operation 

NOP performs no operation. NOP is a one-byte instruction that takes up space 
but affects none of the machine context except (E)IP. 

NOP is an alias mnemonic for the XCHG (E)AX, (E) AX instruction. 



NOT 



One's complement negation 



Opcode Instruction 



Description 



486 



Clocks 

386 286 86 

NOTr/m8 1/3 2/6 2/7 3/16+EA Reverse each bit of r/m byte 
NOTr/ml6 1/3 2/6 2/7 3/16+EA Reverse each bit of r/m word 
2/6 2/7 Reverse each bit of r/m dword 



F6/2 
F7/2 
F7/2 NOTr/m32 1/3 



NOT inverts the operand; every 1 becomes a 0, and vice versa. 



OR 



Logical inclusive OR 





] 


D I 


T S 


Z 


A P C 











* 


* 


? * 




Opcode 


Instruction 




Clocks 




Description 






486 


386 


286 


86 




OCib 


OR AL,imm8 


1 


2 


3 


4 


OR immediate byte to AL 


ODiw 


ORAX,imml6 


1 


2 ' 


3 


4 


OR immediate word to AX 


ODid 


OR EAX,iinm32 


1 


2 






OR immediate dword to EAX 


80 /I ib 


OR r/m8,iinm8 


1/3 


2/7 


3/7 


4/17+EA 


OR immediate byte to r/m byte 


81 /I iw 


OR r/ml6,imml6 1/3 


2/7 


3/7 


4/17+EA 


OR immediate word to r/m word 


81 /I id 


ORr/m32,imm32 1/3 


2/7 






OR immediate dword to r/m 
dword 


83 /I ib 


OR r/ml6,imm8 


1/3 


2/7 






OR sign-extended immediate byte 
with r/m word 


83 /I ib 


ORr/m32,imjm8 


1/3 


2/7 






OR sign-extended immediate byte 
with r/m dword 


08 /r 


ORr/m8,r8 


1/3 


2/6 


2/7 


3/16+EA 


OR byte register to r/m byte 


09 /r 


ORr/ml6,rl6 


1/3 


2/6 


2/7 


3/16+EA 


OR word register to r/m word 


09 /r 


ORr/m32,r32 


1/3 


2/6 






OR dword register to r/m dword 


OA/r 


ORr8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


OR byte register to r/m byte 
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Opcode Inslruction 



Clocks Description 

486 386 286 86 

OB/r ORrl6,r/ml6 1/2 2/7 2/7 3/9+EA OR word register to r/m word 



OB/r ORr32,r/m32 1/2 2/7 



OR dword register to r/m word 



OR computes the inclusive OR of its two operands and places the result in the 
first operand. Each bit of the result is if both corresponding bits of the 
operands are 0; otherwise, each bit is 1. 

The optimized form of OR is SETFLAG (see Chapter 3). 



OUT 



Output to port 








D I T S 


Z A P C 








Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




E6ib 


OUT 
imm8,AL 


16,pm=llV31**, 
vm=29 


10,pm=4*/24** 


3 


10 


Output byte AL to 
immediate port 
number 


E7ib 


OUT 
kmn8,AX 


16,pm=llV31**, 
vm=29 


10,pm=4*/24** 


3 


10 


Output word AX to 
immediate port 
number 


E7ib 


OUT 

imm8,EAX 


16,pm=llV31**, 
vm=29 


10,pm=4*/25** 






Output dword EAX 
to immediate port 
number 


EE 


OUT DX AL 


16,pm=llV31**, 
vm=29 


ll,pm=5*/25** 


3 


8 


Output byte AL to 
port numoer in DX 


EF 


OUT DX,AX 


16,pm=llV31**, 
vm=29 


ll,pm=5V25** 


3 


8 


Output word AX to 
port niunber in DX 


EF 


OUT DX,EAX 


16,piri=llV31**, 
vm=29 


ll,pm=5V25** 






Output dword EAX 
to port number in DX 



*IfCPL<IOPL. 

**If CPL > lOPL or if in virtual 



mode. 



OUT transfers a data byte or data word from the register (AL, AX, or EAX) 
given as the second operand to the output port num.bered by the first operand. 
Output to any port from to 65535 is performed by placing the port number in 
the DX register and then using an OUT instruction with DX as the first operand. 
If the instruction contains an eight-bit port ID, that value is zero-extended to 
16 bits. 



OUTS 
OUTSB 
OUTSW 
OUTSD ' 

Opcode Instruction 



Output string to port 

OUTS/OUTSB/OUTSW 801 86 and greater 
OUTSD 386 processors and greater 



486 



Clocks 

386 



6E 0UTSDX,r/m8 17,pm=10V32**, 14,pm=8V28* 

vm=30 

6F OUTSDX,r/ml6 17,pm=10V32**, 14,pm=8V28* 

vm=30 

6F OUTSDX,r/m32 17,pm=10V32**, 14,pm=8V28* 

vm=30 



286 

5 



Description 



Output byte [(E)SI] 
to port in DX 

Output word [(E)SI] 
to port in DX 

Output dword 



itpu 



[(E)SI]toportinDX 
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opcode Instjruction 

6E OUTSB 



6F 
6F 



OUTSW 



OUTSD 





Clocks 




Description 


486 


386 


286 




17,pm=10V32**, 
vm=30 


14,pm=8V28** 


5 


Output byte 

DS:[(E)SI]toport 

inDX 


17,pm=10V32**, 
vm=30 


14,pm=8V28** 


5 


Output word 
DS:f(E)SI] to port 
number in DX 


17,pm=10V32**, 
vm=30 


14,pm=8V28** 




Output dword 

DS:[(E)SI]toport 

inDX 



OUTS transfers data from the memory byte, word, or doubleword at the 
source-index register to the output port addressed by the DX register. If the 
address-size attribute for this instruction is 16 bits, SI is used for the source- 
index register; otherwise, the address-size attribute is 32 bits, and ESI is used for 
the source-index register. 

OUTS does not allow specification of the port number as an immediate value. 
The port m.ust be addressed through the DX register value. Load the correct 
value into DX before executing the OUTS instruction. 

The address of the source data is determined by the contents of source-index 
register. Load the correct index value into SI or ESI before executing the OUTS 
instruction. 

After the transfer, source-index register is advanced automatically. If the 
direction flag is (CLD was executed), the source-index register is incremented; 
if the direction flag is 1 (STD was executed), it is decremented. The amoimt of 
the increment or decrement is 1 if a byte is output, 2 if a word is output, or 4 if a 
doubleword is output. 

OUTSB, OUTSW, and OUTSD are synonyms for the byte, word, and 
doubleword OUTS instructions. OUTS can be preceded by the REP prefix for 
block output of CX bytes or words. Refer to the REP instruction for details on 
this operation. 



POP 



Pop a word from the stack 







D 


I : 


P 


S Z A 


P 


C 




Opcode 


Instruction 


486 


386 




Clocks 

286 


86 




Description 


8F/0 


POP ml6 


6 


5 




5 


17+EA 


Pop top of stack into memory 


















word 


8F/0 


POP m32 


6 


5 










Pop top of stack into memory 
dword 


58+rw 


POP rl6 


4 


4 




5 


8 




Pop top of stack into word 
register 


58+rd 


POP r32 


4 


4 










Pop top of stack into dword 
register 


IF 


POPDS 


3 


7,pm= 


=21 


5,pm=20 


8 




Pop top of stack into DS 


07 


POPES 


3 


7,pm= 


=21 


5,pm=20 


8 




Pop top of stack into ES 


17 


POPSS 


3 


7,pm= 


=21 


5,pm=20 


8 




Pop top of stack into SS 


OFAl 


POPFS 


3 


7,pm= 


=21 








Pop top of stack into FS 


0FA9 


POPGS 


3 


7,pm= 


=21 








Pop top of stack into GS 
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POP replaces the previous contents of the memory, the register, or the segment 
register operand with the word on the top of the stack, addressed by SS:SP 
(address-size attribute of 16 bits) or SS:ESP (address-size attribute of 32 bits). 
The stack pointer SP is incremented by 2 for an operand-size of 16 bits or by 
4 for an operand-size of 32 bits. It then points to the new top of stack. 

POP CS is not an instruction. Popping from the stack into the CS register is 
accomplished with a RET instruction. 

If the destination operand is a segment register (DS, ES, FS, GS, or SS), the value 
popped must be a selector. In protected mode, loading the selector initiates 
automatic loading of the descriptor information associated with that selector 
into the hidden part of the segment register; loading also initiates validation of 
both the selector and the descriptor information. 

A null value (0000-0003) may be popped into the DS, ES, FS, or GS register 
without causing a protection exception. An attempt to reference a segment 
whose corresponding segment register is loaded with a null value causes a 
general protection fault. No memory reference occurs. The saved value of the 
segment register is null. 

A POP SS instruction inhibits all interrupts, including NMI, until after 
execution of the next instruction. This allows sequential execution of POP SS 
and POP ESP instructions without danger of having an invalid stack during an 
interrupt. However, use of the LSS instruction is the preferred method of 
loading the SS and ESP registers. 

Note: Turbo Assember extends the syntax of the POP instruction to facilitate 
popping multiple items in sequence. The items popped can include any legal 
POP value, including registers, immediate values, and memory locations. This 
feature does not actually affect the code generated. 

POPA Pop all general registers 

POPAD POPA 80186 processors and greater 

POPAW POPAD 386 processors and greater 








D 


I T 


S 


ZAP C 


Opcode 


Instruction 




Clocks 


Description 






486 


386 


286 




61 


POPA 


9 


24 


19 


Pop DI, SI, BP, BX, DX, CX, AX 


61 


POPAD 


9 


24 




Pop EDI, ESI, EBP, EBX, EDX, ECX, EAX 


61 


POPAW 


9 


24 


19 


Pop DI, SI, BP, BX, DX, CX, AX 



POPA pops the eight 16- or 32-bit general registers depending on the segment 
size. However, the SP value is discarded instead of loaded into SP. POPA 
reverses a previous PUSHA, restoring the general registers to their values 
before PUSHA was executed. The first register popped is DI. 

POPAD pops the eight 32-bit general registers. The ESP value is discarded 
instead of loaded into ESP. POPAD reverses the previous PUSHAD, restoring 
the general registers to their values before PUSHAD was executed. The first 
register popped is EDI. 

POPAW pops WORD-sized registers. (Can only be used for VERSION T320 or 
higher.) 
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POPF Pop from stack into FLAGS or EFLAGS register 

POPFD POPFD 386 processors and greater 



POPFW 

* 


D I 
* * 


T 
* 


S Z 
* * 


A 
* 


P 

* 


C 
* 


Opcode 


Instruction 


486 


Clocks 

386 286 






Description 




86 






9D 


POPF 


9,pm=6 


5 


5 


8 




Pop top of stack into FLAGS 


9D 


POPFD 


9,pm=6 


5 








Pop top of stack into EFLAGS 


9D 


POPFW 


9,pm=6 


5 


5 


8 




Pop top of stack into FLAGS 



POPF/POPFD pops the word or doubleword on the top of the stack and stores 
the value in the flags register. If the operand-size attribute of the instruction is 
16 bits, then a word is popped and the value is stored in FLAGS. If the operand- 
size attribute is 32 bits, then a doubleword is popped and the value is stored in 
EFLAGS. 

Note that bits 16 and 17 of EFLAGS, called VM and RF, respectively, are not 
affected by POPF or POPFD. 

The I/O privilege level is altered only when executing at privilege level 0. The 
interrupt flag is altered or\ly when executing at a level at least as privileged as 
the I/O privilege level. (Real-address mode is equivalent to privilege level 0.) If 
a POPF instruction is executed with insufficient privilege, an exception does not 
occur, but the privileged bits do not change. 

POPFW always pops into FLAGS WORD-style. (Can only be used for 
VERSION T320 or higher.) 



PUSH 



Pusli operand onto the stack 








D I 


T 


S Z 


A P 


C 


Opcode 


Instruction 


486 


386 


Clocks 

286 


86 


Description 








FF/6 


PUSHml6 


4 


5 


5 


16+EA 


Push memory word 


FF/6 


PUSHm32 


4 


5 






Push memory dword 


50+ /r 


PUSHrl6 


1 


2 


3 


11 


Push register word 


50+ /r 


PUSHr32 


1 


2 






Push register dword 


6A 


PUSHlmmS 


1 


2 


3 




Push immediate byte 


68 


PUSHimml6 


1 


2 


3 




Push immediate word 


68 


PUSHimm32 


1 


2 






Push irrunediate dword 


OE 


PUSHCS 


3 


2 


3 


10 


Pushes 


16 


PUSHSS 


3 


2 


3 


10 


PushSS 


IE 


PUSHDS 


3 


2 


3 


10 


PushDS 


06 


PUSHES 


3 


2 




10 


PushES 


OF AC 


PUSHES 


3 


2 






PushFS 


0FA8 


PUSHGS 


3 


2 






PushGS 



PUSH decrements the stack pointer by 2 if the operand-size attribute of the 
instruction is 16 bits; otherwise, it decrements the stack pointer by 4. PUSH then 
places the operand on the new top of stack, which is pointed to by the stack 
pointer. 
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The 386 PUSH ESP instruction pushes the value of the ESP as it existed before 
the instruction. The 80286 PUSH SP instruction also pushes the value of SP as it 
existed before the instruction. This differs from the 8086, where PUSH SP 
pushes the new value (decremented by 2). 

Note: Turbo Assember extends the syntax of the PUSH instruction to facilitate 
pushing multiple items in sequence. The itenis pushed can include any legal 
PUSH value, including registers, immediate values, and memory locations. 
This feature does not actually affect the code generated. In addition, the PUSH 
instruction allows constant arguments even when generating code for the 8086 
processor. Such instructions are replaced in the object code by a 10-byte 
sequence that simulates the 80186/286/386 PUSH immediate value instruction. 

PUSHA Push all general registers 

PUSHAD PUSHA 80186 processors and greater 

PUSHAW PUSHAD 386 processors and greater 








D 


I T 


S 


Z A P C 


Opcode 


Instruction 




Clocks 


Description 






486 


386 


286 




60 


PUSHA 


11 


18 


17 


Push AX,CX,DX,BX,original SP,BP,SI 


60 


PUSHAD 


11 


18 




Push EAX,ECX,EDX,EBX 


60 


PUSHAW 


11 


18 


17 


Push AX,CX,DX,BX,original SP,BP,SI 



PUSHA and PUSHAD save the 16-bit or 32-bit general registers, respectively, 
on the stack depending on the segment size. PUSHA decrements the stack 
pointer (SP) by 16 to hold the eight word values. PUSHAD decrements the 
stack pointer (ESP) by 32 to hold the eight doubleword values. Because the 
registers are pushed onto the stack in the order in which they were given, they 
appear in the 16 or 32 new stack bytes in reverse order. The last register pushed 
isDIorEDL 

PUSHAW always pushes WORD-style. (Can only be used for VERSION T320 
or higher.) 

PUSHF Push flags register onto the stack 

PUSHFD PUSHFD 386 processors and greater 

PUSHFW ODITSZAPC 



Opcode 


Instruction 




Clocks 




Description 






486 


386 


286 


86 




9C 


PUSHF 


4,pm=3 


4 


3 


10 


Push FLAGS 


9C 


PUSHFD 


4,pm=3 


4 






PushEFLAGS 


9C 


PUSHFW 


4,pm=3 


4 


3 


10 


Push FLAGS 



PUSHF decrements the stack pointer by 2 and copies the FLAGS register to the 
new top of stack; PUSHFD decrements the stack pointer by 4, and tiie 386 
EFLAGS register is copied to the new top of stack which is pointed to by 
SS:ESP. 

PUSHFW always pops WORD-sized registers. (Can only be used for VERSION 
T320 or higher.) 
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RCL Rotate 

RCR D 

ROL 
ROR 

Opcode Instruction 

DO /2 RCL r/m8,l 3/4 

D2 /2 RCL r/m8,CL 8-30/9-31 

C0/2ib RCLr/m8,imm8 8-30/9-31 

Dl 11 RCL r/inl6,l 3/4 



486 



DO/3 RCRr/m8,l 



3/4 



Dl/3 RCRr/m32,l 3/4 



Clocks 

386 286 86 

9/10 2/7 2/15+EA 

9/10 5/8 8+4perbit/(20+4 
per bit)+EA 

9/10 5/8 

9/10 2/7 2/15+EA 



D3/2 RCLr/ml6,CL 8-30/9-31 

Cl/2ib RCLr/ml6,iiran8 8-30/9-31 9/10 5/8 



9/10 5/8 8+4perbit/(20+4 
per Dit)+EA 



Dl/2 RCLr/m32,l 3/4 9/10 

D3/2 RCLr/m32,CL 8-30/9-31 9/10 

Cl/2ib RCLr/m32,imm8 8-30/9-31 9/10 



9/10 2/7 2/15+EA 



D2/3 RCRr/ni8,CL 8-30/9-31 

C0/3ib RCRr/m8,mim8 8-30/9-31 9/10 5/8 

Dl/3 RCRr/ml6,l 3/4 



9/10 5/8 8+4 per bit/ (20+4 
per bit)+EA 



9/10 2/7 2/15+EA 



D3/3 RCRr/ml6,CL 8-30/9-31 

Cl/3ib RCRr/ml6,imm8 8-30/9-31 9/10 5/8 



9/10 5/8 8+4 per bit/ (20+4 
per bit)+EA 



9/10 



D3/3 RCRr/m32,CL 8-30/9-31 9/10 



Description 



Rotate 9 bits 
(CF,r/mbyte) 
left once 

Rotate 9 bits 
(CF,r/mbyte) 
left CL times 

Rotate 9 bits 
(CF,r/mb;yte) 
left imin8 times 

Rotate 17 bits 
(CF,r/mword) 
left once 

Rotate 17bits (CF, 
r/m word) left CL 
times 

Rotate 17 bits 
(CF,r/m word)) 
left immS times 

Rotate 33 bits 
(CF,r/m dword) 
left once 

Rotate 33 bits 
(CF,r/m dword) 
left CL times 

Rotate 33 bits 
(CF,r/m dword) 
left, imm8 times 

Rotate 9 bits 
(CF,r/mbyte) 
right once 

Rotate 9 bits 
(CF,r/mbyte) 
right CL times 

Rotate 9 bits 
(CF,r/m byte) 
right immo times 

Rotate 17 bits 
(CF,r/m word) 
right once 

Rotate 17 bits 
(CF,r/m word) 
right CL times 

Rotate 17 bits 
(CF,r/m word) 
right imm8 times 

Rotate 33 bits 
(CF,r/m dword) 
right once 

Rotate 33 bits 
(CF,r/m dword) 
right CL times 
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Opcode Instruction 



486 



Cl/3ib RCRr/m32,imm8 8-30/9-31 

DO/0 ROLr/m8,l 3/4 

D2/0 ROLr/m8,CL 3/4 

CO/Oib ROLr/m8,mun8 2/4 

Dl/0 ROLr/ml6,l 3/4 

D3/0 ROLr/ml6,CL 3/4 

Cl/Oib ROLr/ml6,imm8 2/4 

Dl/0 ROLr/m32,l 3/4 

D3/0 ROLr/m32,CL 3/4 

Cl/Oib ROLr/m32,iram8 2/4 

DO /I RORr/m8,l 3/4 

D2/1 RORr/m8,CL 3/4 

CO /I ib ROR r/m8, iirnnS 2/4 

Dl/1 RORr/ml6,l 3/4 

D3/1 RORr/ml6,CL 3/4 

CI /lib RORr/ml6,iimn8 2/4 

Dl/1 RORr/in32,l 3/4 

D3/1 RORr/m32,CL 3/4 

CI /lib RORr/m32,itnm8 2/4 





Clocks 


Description 


386 


286 


86 




9/10 






Rotate 33 bits 
(CF,r/m dword) 
right inunS times 


3/7 


2/7 


2/15+EA 


Rotate 8 bits r/m 
byte left once 


3/7 


5/8 


8+4perbit/(20+4 
perbit)+EA 


Rotate 8 bits r/m 
byte left CL times 


3/7 


5/8 




Rotate 8 bits r/m 
byte left immS 
times 


3/7 


2/7 


2/15+EA 


Rotate 16 bits 
r/m word left 
once 


3/7 


5/8 


8+4perbit/(20+4 
per bit)+EA 


Rotate 16 bits 
r/m word left CL 
times 


3/7 


5/8 




Rotate 16 bit r/m 
word left imm8 
times 


3/7 






Rotate 32 bits 
r/m dword left 
once 


3/7 






Rotate 32 bits 
r/m dword left 
CL times 


3/7 






Rotate 32 bits 
r/m dword left 
immS times 


3/7 


2/7 


2/15+EA 


Rotate 8 bits r/m 
byte right once 


3/7 


5/8 


8+4 per bit/ (20+4 
perbit)+EA 


Rotate 8 bits r/m 
byte right CL 
times 


3/7 


5/8 




Rotate 8 bits r/m 
word right imm8 
tunes 


3/7 


2/7 


2/15+EA 


Rotate 16 bits 
r/m word right 
once 


3/7 


5/8 


8+4 per bit/ (20+4 
perDit)+EA 


Rotate 16 bits 
r/m word right 
CL times 


3/7 


5/8 




Rotate 16 bit r/m 
word right imm8 
times 


3/7 






Rotate 32 bits 
r/m dword right 
once 


3/7 






Rotate 32 bits 
r/m dword right 
CL times 


3/7 






Rotate 32 bits 
r/m dword right 
imm8 times 



Add 1 dock to the times shown for each rotate made (80286 only). 

Each rotate instruction shifts the bits of the register or memory operand given. 
The left rotate instructions shift all the bits upward, except for the top bit, which 
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is returned to the bottom. The right rotate instructions do the reverse: The bits 
shift downward until the bottom bit arrives at the top. 

For the RCL and RCR instructior\s, the carry flag is part of the rotated quantity. 
RCL shifts the carry flag into the bottom bit and shifts the top bit into the carry 
flag; RCR shifts the carry flag into the top bit and shifts the bottom bit into the 
carry flag. For the ROL and ROR instructions, the original value of the carry 
flag is not a part of the result, but the carry flag receives a copy of the bit that 
was shifted from one end to the other. 

The rotate is repeated the number of times indicated by the second operand, 
which is either an immediate number or the contents of the CL register. To 
reduce the maximimi instruction execution time, the 80286/386 does not allow 
rotation counts greater than 31. If a rotation count greater than 31 is attempted, 
only the bottom five bits of the rotation are used. The 8086 does not mask 
rotation counts. The 386 in virtual 8086 mode does mask rotation counts. 

The overflow flag is defined only for the single-rotate forms of the instructions 
(second operand = 1). It is undefined in all other cases. For left shifts/rotates, 
the CF bit after the shift is XORed with the high order result bit. For right 
shifts/rotates, the high-order two bits of the result are XORed to get OF. 

RDMSR Read from Model Specific Register 

Pentium processors and greater 



Opcode Instruction Clocks Description 

Pentium 

OF 32 RDMSR 20-24 Read Model Specific Register indicated by ECX into 
EDX:EAX 

The value in ECX specifies one of the 64-bit Model Specific Registers of the 
Pentium processor. The content of that Model Specific Register is copied into 
EDX:EAX. EDX is loaded with the high-order 32 bits, and EAX is loaded with 
the low-order 32 bits. 

The following values are used to select model specific registers on the Pentium 
processor: 

Value (in Hex) Register Name Description 

OOh Machine Check Address Stores address of cycle causing 

the exception. 

Olh Machine Check Type Stores cycle type of cycle 

causing the exception. 

Other values used to preform cache, TLB and BTB testing and performance 
monitoring, are available under a non-disclosure agreenient from Intel. 

Protected mode exceptioris: #GP(0) if either the current privilege level is not or 
the value in ECX does not specify a Model-Specific Register that is 
implemented in the Pentium processor. 

Real mode exceptions: #GP if the value in ECX does not specify a Model- 
Specific Register that is implemented in the Pentium processor. 

Virtual 8086 mode exceptions: #GP(0) if instruction execution is attempted. 

Notes: This instruction must be executed at privilege level or in real-address 
mode; otherwise a protection exception will be generated. 
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If less than 64 bits are implemented in a model specific register, the value 
returned to EDXrEAX, in the locations corresponding to the unimplemented 
bits, is unpredictable. 

RDMSR is used to read the content of Model-Specific Registers that control 
functions for testability, execution tracing, performance m.onitoring and 
machine check errors. Refer to the Pentium Processor Data Book for more 
information or contact Intel. 

The values 3h, OFh, and valines above 13h are reserved. Do not execute RDMSR 
with reserved values in ECX. 

RDTSC (Proprietary instruction. Contact Intel for more information.) 

Pentium processors and greater 



REP 

REPE 

REPZ 

REPNE 

REPNZ 



Repeat following string operation 



Opcode Instruction 



Clocks 



Description 



486 



386 



286 



86 



F3 6C REP INS 16+8(E)CX, 

r/m8,DX pm=10+8(E)CX*V 
30+8(E)CX*^VM= 
29+8(E)CX 



F3 6D REP INS 16+8(E)CX, 

r/ml6,DX pm=10+8(EJCX*V 
30+8(E)CX*2,VM= 
29+8(E)CX 

F3 6D REP INS 16+8(E)CX, 

r/m32,DX pm=10+8(E)CX*V 
30+8(E)CX*^VM= 
29+8(E)CX 

F3A4 REPMOVS 5*3,13*^,12+3(E) 5+4*(E)CX 

m8,m8 CX*^ 



13+6*(E)CX, 5+4*CX 

pm=7+6*(E)CX/ 

27+6*^*(E)CX*2 

13+6*(E)CX, 5+4*CX 



pm=7+6*(E)CX/ 
27+6*^*(E)CX*2 

13+6*(E)CX, 

pm=7+6*(E)CX/ 

27+6*^*(E)CX*2 



F3A5 REPMOVS 5=^,13*^,12+3(E) 
ml6,ml6 CX*^ 



F3A5 REPMOVS 5=^,13*^,12+3(E) 
m32,m32 CX*^ 



F3 6E REP OUTS 17+5(E)CX, 

DX,r/m8 pm=ll+5(EjCX*V 
31+5(E)CX*2 

F3 6F REP OUTS 17+5(E)CX, 

DX,r/ml6 pm=ll+5(E)CX*V 
31+5(E)CX*2 

F3 6F REP OUTS 17+5(E)CX, 

DX,r/m32 pm=ll+5(E)CX*V 

31+5(E)CX*2 



5+4*(E)CX 



5+4*(E)CX 



5+12*(E)CX, 
pm=6+5*(E) 
CX/26+5*^*(E) 
CX*2 

5+12*(E)CX, 
pm=6+5*(E) 
CX/26+5*^*(E) 
CX*2 

5+12*(E)CX, 
pm=6+5*(E) 
CX/26+5*^*(E) 
CX*2 



Input (E)CX 
hjtes from 
port DX into 
feS:[(E)DI] 

Input (E)CX 
words from 
port DX into 
feS:[(E)DI] 

Input (E)CX 
dwords from 
port DX into 
ES:[(E)DI] 

5+4*CX 9+17*CX Move(E)CX 
b3^es from 
[(E)SI]to 
ES:[(E)DI] 

5+4*CX 9+17*CX Move(E)CX 
words from 
[(E)SI]to 
ES:[(E)DI] 

Move (E)CX 
dwords from 
[(E)SI]to 
ES:[(E)DI] 



5+4*CX 



5+4*CX 



Output (E)CX 
bytes from 
[(E)SI] to port 
DX 

Output (E)CX 
words from 
[(E)SI] to port 
DX 

Output(E)CX 
dwords from 
[(E)SI]toport 
DX 
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Opcode Instruction 



Clocks 



F2AC 
F2AD 
F2AD 
F3AA 

F3AB 

F3AB 

F3A6 

F3A7 

F3A7 

F3AE 
F3AF 
F3AF 

F2A6 
F2A7 
F2A7 
F2AE 



REPLODS 
m8 

REP LODS 
ml6 

REP LODS 
m32 

REPSTOS 
m8 



REPSTOS 
ml6 



REPSTOS 
m32 



REPE 
CMPS 
m8,m8 



REPE 
CMPS 
ml6,ml6 



REPE 

CMPS 
m32,m32 



REPE 

SCASm8 

EPESCAS 
ml6 

REPE 

SCASm32 



REPNE 

CMPS 

m8,m8 



REPNE 

CMPS 

inl6,ml6 



REPNE 

CMPS 

m32,m32 



REPNE 
SCASmS 



486 

5»3,7+4(E)CX'^ 

5*3,7+4(E)CX»^ 
5*3,7+4(E)CX»^ 
5'^,7+4(E)CX*^ 

5*^,7+4(E)CX*^ 

5'^,7+4(E)CX*^ 

5*3,7+7(E)CX*^ 

5'^,7+7(E)CX*^ 

5*3,7+7(E)CX*^ 

5*^,7+5(E)CX*^ 
5*3,7+5(E)CX*^ 
5'^,7+5(E)CX*^ 



386 



286 



86 



5+5*(E)CX 
5+5*(E)CX 
5+5*(E)CX 
5+9*N 

5+9*N 

5+9*N 

5+8*N 
5+8*N 
5+8*N 



5=^,7+7(E)CX*^ 5+9*N 



5*3,7+7(E)CX*^ 5+9*N 



5'^,7+7(E)CX'^ 5+9*N 



4+3*CX 9+10*CX 



44-3*CX 9+10*CX 



5+9*N 9+22*N 



5+9*N 9+22*N 



5+8*N 9+15*N 



5+8*N 9+15*N 



5+9*N 9+22*N 



5+9*N 9+22*N 



5*3,7+5(E)CX*^ 



5+8*N 



5+8*N 9+15*N 



Description 



Load (E)CX 
bytes from 
[(E)SI]toAL 

Load (E)CX 
words from 
[(E)SI] to AX 

Load (E)CX 
dwords from 
[(E)SI] to FAX 

FiU (E)CX 
bytes at 
ES:[(E)DI] 
with AL 

FiU (E)CX 
words at 
ES:[(E)DI] 
with AX 

FiU (E)CX 
dwords at 
ES:[(E)DI] 
withEAX 

Find 

nonmatching 
bytes in 
ES:[(E)DI] and 
[(E)SI] 

Find 

nonmatching 
words in 
ES:[(E3DI] and 
[(E)SI] 

Find 

nonmatching 
dwords in 
ES:[(E)DI] and 
[(E)Sll 

Find non-AL 
byte starting at 
ES:[(E)DI] 

Find non-AX 
word starting 
atES:[(E)DI] 

Find non- 
EAX dword 
starting at 
ES:[(E)DI] 

Find 

matching 
bytes in 
ES:[(E)DI] and 
[(E)SII 

Find 

matching 
words in 
ES:[(E)DI] and 
[(E)SI] 

Find 

matching 
dwords m 
ES:[(E)DI] and 
[(E)Sll 

FindAL 
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Opcode Instruction 



486 

5*3,7+5(E)CX*6 



F2AF REPNE 

SCASml6 

F2AF REPNE 5*^,7+5(E)CX'^ 

SCASm32 



Clocks Description 

386 286 86 

5+8*N 5+8*N 9+15*N Find AX 

5+8*N Find EAX 



*lIfCPL<IOPL 
*2IfCPL>IOPL 
*3If(E)CX = 
*4If(E)CX = l 
*5If(E)CXl 
*6If(E)CX0 

REP, REPE (repeat while equal), and REPNE (repeat while not equal) are 
prefixes that are applied to string operations. Each prefix causes the string 
instruction that f oUows to be repeated the number of times indicated in the 
coimt register or (for REPE and REPNE) until the indicated condition in the 
zero flag is no longer met. 

Synonymous forms of REPE and REPNE are REPZ and REPNZ, respectively. 

The REP prefixes apply only to one string instruction at a time. To repeat a 
block of instructions, use the LOOP instruction or another looping construct. 

The precise action for each iteration is as follows: 

1 If the address-size attribute is 16 bits, use CX for the count register; if the 
address-size attribute is 32 bits, use ECX for the coimt register. 

2 Check CX. If it is zero, exit the iteration, and move to the next instruction. 

3 Acknowledge any pending interrupts. 

4 Perform tiie string operation once. 

5 Decrement CX or ECX by one; no flags are modified. 

6 Check the zero flag if the string operation is SCAS or CMPS. If the repeat 
condition does not hold, exit the iteration and move to the next instruction. 
Exit the iteration if the prefix is REPE and ZF is (the last comparison was 
not equal), or if the prefix is REPNE and ZF is one (the last comparison was 
equal). 

7 Return to step 1 for the next iteration. 

Repeated CMPS and SCAS instructions can be exited if the count is exhausted 
or if the zero flag fails the repeat condition. These two cases can be 
distinguished by using either the JCXZ instruction, or by using the conditional 
jumps that test the zero flag (JZ, JNZ, and JNE). 



RET 



Return from procedure 





D I 


T S Z A 


P C 








Opcode Instruction 




Clocks 








description 




486 


386 


286 




86 




C3 RET 


5 


10+m 


11 




16 


Return (near) to 
caller 


CB RET 


13,pm=18 


18+m,pm=32+m 


15,pm= 


=25 


26 


Return (far) to caller, 
same privilege 


CB RET 


13,pm=33 


pm=68 


55 






Return (far) 
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Opcode 


Instruction 


Clocks 

486 386 286 


86 


Description 


C2iw 


RETiimnl6 


5 10+m 11 


20 


Return (near) 


CAiw 


RETimml6 


14,pm=17 18+m,pm=32+m 15,pm=25 


25 


Return (far) pop 
iirunl6 bytes 


CAiw 


RETiinml6 


14,pm=33 pm=68 55 




Return (far) 



RET transfers control to a return address located on the stack. The address is 
usually placed on the stack by a CALL instruction, and the return is made to the 
instruction that follows the CALL. 

The optional numeric parameter to RET gives the number of stack bytes 
(OperandMode = 16) or words (OperandMode = 32) to be released after the 
return address is popped. These items are typically used as input parameters to 
the procedure called. 

For the intrasegment (near) return, the address on the stack is a segment offset, 
which is popped into the instruction pointer. The CS register is unchanged. For 
the intersegment (far) return, the address on the stack is a long pointer. The 
offset is popped first, followed by the selector. 

In real mode, CS and IF are loaded directly. In protected mode, an intersegment 
return causes the processor to check the descriptor addressed by the return 
selector. The ARbyte of the descriptor must indicate a code segment of equal or 
lesser privilege (or greater or equal numeric value) than the current privilege 
level. Returns to a lesser privilege level cause the stack to be reloaded from the 
value saved beyond the parameter block. 

The DS, ES, FS, and GS segment registers can be set to by the RET instruction 
during an inter-level transfer. If these registers refer to segments that cannot be 
used by the new privilege level, they are set to to prevent imauthorized access 
from the new privilege level. 



RSM 



Resume from System Management Mode 
Pentium processors and greater 

ODITSZAPC 



Opcode Instruction 



OFAA 



RSM 



Clocks 
Pentixim 

83 



Description 

Resume operation of interrupted program. 



Resume operation of a program by a System Management Mode (SMM) 
interrupt. The processor state is restored from the dump created upon entrance 
to SMM. Note, however, that the contents of the model-specific registers are not 
affected. The processor leaves SMM and returns control to the interrupted 
application or operating system. If the processor detects any invalid state 
information, it enters the shutdown state. This happens in any of the following 
situations: 

• The value stored in the State Dump Base field is not a 32 Kbyte aligned 
address. 

• Any reserved bit in CR4 is set to 1. 

• Any combination of bits in CRO is illegal; namely, (PG=1 and PE=0) or 
(NW=1 and CD=0). 
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Protected mode. Real mode, and Virtual 8086 mode exception: #UD if an 
attempt is made to execute this instruction when the processor is not in SMM. 

Notes: for more information about SMM and the behavior of the RSM 
instruction, see the Pentium Processor User's Manual (available from Intel). 



SAHF 



Store AH into Flags 



Opcode Instruction Clocks 

486 386 286 86 

9E SAHF 2 3 2 4 



Description 

Store AH flags SF ZF xx AF xx PF xx CF 



SAHF loads the flags listed above with values from the AH register, from bits 7, 
6, 4, 2 and 0, respectively. 



SAL 
SAR 
SHL 
SHR 



Shift instructions 



Opcode 

DO/4 
D2/4 

C0/4ib 

Dl/4 

D3/4 

CI /4 ib 

Dl/4 
D3/4 
Cl/4ib 

DO/7 

D2/7 

C0/7ib 

Dl/7 

D3 /7 

Cl/7ib 

Dl/7 



Instructioii 

486 

SALr/m8,l 3/4 

SALr/m8,CL 3/4 

SALr/m8,iimn8 2/4 
SALr/ml6,l 3/4 
SALr/ml6,CL 3/4 



Clocks 
386 286 86 

3/7 2/7 2/15+EA 

3/7 5/8 8+4 per bit/(20+4 per 
bit)+EA 

3/7 5/8 

3/7 2/7 2/15+EA 

3/7 5/8 8+4 per bit (20+4 per 



bit)+EA 



SALr/ 
ml6,imm8 

SALr/m32,l 

SALr/m32,CL 

SALr/ 
in32,imm8 

SARr/m8,l 



2/4 3/7 5/8 



3/4 
3/4 
2/4 

3/4 



3/7 
3/7 
3/7 



SARr/m8,CL 3/4 

SARr/ 2/4 
m8,itnin8 

SARr/ml6,l 3/4. 

SARr/ml6,CL 3/4 

SARr/ 2/4 
ml6,imm8 

SARr/m32,l 3/4 



3/7 2/7 2/15+EA 

8+4 per; 
bit)+EA 



3/7 5/8 8+4 permit (20+4 per 



3/7 5/8 

3/7 2/7 2/15+EA 

3/7 5/8 8+4 per bit (20+4 per 

' ")+E/ 



bit)+EA 



3/7 5/8 
3/7 



Description 



Multiply r/m byte by 2 

Miiltiply r/m byte by 2, 
CL times 

Multiply r/m b3M:e by 2 

Multiply r/m word by 2 

Multiply r/m word by 2, 
CL times 

Multiply r/m word by 2 

Multiply r/m dword by 2 
Multiply r/m dword by 2 
Multiply r/m dword by 2 

Signed divide** r/m byte 
by 2 

Signed divide** r/m byte 
by 2 

Signed divide** r/m byte 
by2 

Signed divide** r/m word 
by 2 

Signed divide** r/m word 
by 2 

Signed divide** r/m word 
by2 

Signed divide** r/m 
dword by 2 
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Opcode 


Instruction 






C 
286 


:iocks 




486 


386 


86 


D3/7 


SARr/m32,CL 


3/4 


3/7 






Cl/7 


SARr/ 
m32,imm8 


2/4 


3/7 






DO/4 


SHLr/m8,l 


3/4 


3/7 


2/7 


2/15+EA 


D2/4 


SHLr/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 per 
bit)+EA 


C0/4ib 


SHLr/ 
m8,itnm8 


2/4 


3/7 


5/8 




Dl/4 


SHLr/ml64 


3/4 


3/7 


2/7 


2/15+EA 


D3/4 


SHLr/ml6,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 per 
bit)+TBA 


CI /4 ib 


SHLr/ 
ml6,imm8 


2/4 


3/7 


5/8 




Dl/4 


SHL r/m32,l 


3/4 


3/7 






D3/4 


SHLr/m32,CL 


3/4 


3/7 






Cl/4ib 


SHLr/ 
m32,inun8 


2/4 


3/7 






DO/5 


SHRr/m8,l 


3/4 


3/7 


2/7 


2/15+EA 


D2/5 


SHRr/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 per 
bit)+^A 


CO /5 ib 


SHRr/ 
m8,itmn8 


2/4 


3/7 


5/8 




Dl/5 


SHRr/ml6,l 


3/4 


3/7 


2/7 


2/15+EA 


D3/5 


SHRr/ml6,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 per 
bit)+EA 


CI /5 ib 


SHRr/ 
ml6,imm8 


2/4 


3/7 


5/8 




Dl/5 


SHRr/m32,l 


3/4 


3/7 






D3/5 


SHRr/m32,CL 


3/4 


3/7 






Cl/5ib 


SHRr/ 
m32,imm8 


2/4 


3/7 


» 





Description 



Signed divide** r/m 
dword by 2, 
CL times 

Signed divide** r/m 
dword by 2 

Mviltiply r/m byte by 2 

Multiply r/m byte by 2, 
CL times 

Multiply r/m byte by 2 

Multiply r/m word by 2 

Multiply r/m word by 2, 
CL times 

Multiply r/m word by 2 

Multiply r/m dword by 2 
Multiply r/m dword by 2 
Multiply r/m dword by 2 

Ur\signed divide r/m byte 
by 2 

Unsigned divide r/m byte 
by 2 

Unsigned divide r/m b5^e 
by 2 

Unsigned divide r/m 
word by 2 

Unsigned divide r/m 
word by 2 

Unsigned divide r/m 
word by 2 

Unsigned divide r/m 
dword by 2 

Unsigned divide r/m 
dword by 2 

Unsigned divide r/m 
dword by 2 



**Not the same division as EDIV; rounding is toward negative infinity. 

SAL (or its synonym, SHL) shifts the bits of the operand upward. The high- 
order bit is shifted into the carry flag, and the low-order bit is set to 0. 

SAR and SHR shift the bits of the operand downward. The low-order bit is 
shifted into the carry flag. The effect is to divide the operand by 2. SAR 
performs a signed divide with rounding toward negative infinity (not the same 
as IDIV); the high-order bit remains the same. SHR performs an tinsigned 
divide; the high-order bit is set to 0. 

The shift is repeated the number of times indicated by the second operand, 
which is either an immediate number or the contents of the CL register. To 
reduce the maximiun execution time, the 80286/386 does not allow shift counts 
greater than 31. If a shift count greater than 31 is attempted, only the bottom 
five bits of the shift count are used. (The 8086 uses all eight bits of the shift 
count.) 
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The overflow flag is set only if the single-shift forms of the instructions are 
used. For left shifts, OF is set to if the high bit of the answer is the same as the 
result of the carry flag (that is, the top two bits of the original operand were the 
same); OF is set to 1 ii they are different. For SAR, OF is set to for all single 
shifts. For SHR, OF is set to the high-order bit of the original operand. 



SBB 



Integer subtraction with borrow 



D 



4/17+EA 
4/17+EA 



Opcode Instruction Clocks 

486 386 286 86 

ICib SBBAL,iinm8 12 3 4 

IDiw SBBAX,iinml6 1 2 3 4 

ID id SBBEAX,imm32 1 2 

80/3ib SBBr/m8,imm8 1/3 2/7 3/7 

81/3iw SBBr/ml6,imml6 1/3 2/7 3/7 

81/3id SBBr/m324mm32 1/3 2/7 

83/3ib SBBr/ml6,imm8 1/3 2/7 3/7 

83/3ib SBBr/m32,imm8 1/3 2/7 

18 /r SBBr/m8,r8 1/3 2/6 2/7 3/16+EA 

19 /r SBB r/ml6,rl6 1/3 2/6 2/7 3/16+EA 

19 /r SBB r/m32,r32 1/3 2/6 

lA/r SBBr8,r/m8 1/2 2/7 2/7 3/9+EA 

IB/r SBBrl6,r/ml6 1/2 2/7 2/7 3/9+EA 

IB/r SBBr32,r/m32 1/2 2/7 



Description 



Subtract with borrow immediate 
byte from AL 

Subtract with borrow immediate 
word from AX 

Subtract with borrow immediate 
dword from EAX 



Subtract with borrow immediate 
bj^e from r/m byte 

Subtract with borrow immediate 
word from r/m word 

Subtract with borrow immediate 
dword from r/m dword 

4/17+EA Subtract with borrow sign-extended 
immediate byte from r/m word 

Subtract with borrow sign-extended 
immediate byte from r/m dword 



Subtract with borrow byte register 
from r/m byte 

Subtract with borrow word register 
from r/m word 

Subtract with borrow dword register 
from r/m dword 

Subtract with borrow byte register 
from r/m byte 

Subtract with borrow word register 
from r/m word 

Subtract with borrow dword register 
from r/m dword 



SBB adds the second operand (DEST) to the .carry flag (CF) and subtracts the 
result from the first operand (SRC). The result of the subtraction is assigned to 
the first operand (DEST), and the flags are set accordingly. 

When an immediate byte value is subtracted from a word operand, the 
immediate value is first sign-extended. 
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SCAS Compare string data 

SCASB SCASD 386 processors and greater 



SCAS^ 
SCASI 


Instruction 


D 

* 

486 


I 


T S 

* 


Z 

* 


A P C 
* * * 


Opcode 


Clocks 


Description 




386 


286 


86 




AE 


SCASmS 


6 


7 


7 


15 


Compare bytes AL - ES:[DI] 


AF 


SCASmie 


6 


7 


7 


15 


Compare words AX - ES: [DI] 


AF 


SCASm32 


6 


7 






Compare dwords EAX - ES: [DI] 


AE 


SCASB 


6 


7 


7 


15 


Compare bytes AL - ES:[DI] 


AF 


SCASW 


6 


7 


7 


15 


Compare words AX - ES: [DI] 


AF 


SCASD 


6 


7 






Compare dwords EAX - ES: [DI] 



SCAS subtracts tlie memory byte or word at the destination register from the 
AL, AX or EAX register. The result is discarded; only the flags are set. The 
operand must be addressable from the ES segment; no segment override is 
possible. 

If the address-size attribute for this instruction is 16 bits, DI is used as the 
destination register; otherwise, the address-size attribute is 32 bits and EDI is 
used. 

The address of the memory data being compared is determined solely by the 
contents of the destination register, not by the operand to SCAS. The operand 
validates ES segment addressability and determines the data type. Load the 
correct index value into DI or EDI before executing SCAS. 

After the comparison is made, the destination register is automatically updated. 
If the direction flag is (CLD was executed), the destination register is 
incremented; if the direction flag is 1 (STD was executed), it is decremented. 
The increments or decrements are by 1 if bytes are compared, by 2 if words are 
compared, or by 4 if doublewords are compared. 

SCASB, SCASW, and SCASD are S5mon5niis for the byte, word and doubleword 
SCAS instructions that don't require operands. They are simpler to code, but 
provide no type or segment checking. 

SCAS can be preceded by the REPE or REPNE prefix for a block search of CX or 
ECX bytes or words. Refer to the REP instruction for further details. 



SETcc 



Byte set on condition 
386 processors and greater 



Opcode Instruction 



OF 97 
OF 93 
OF 92 
OF 96 
OF 92 
OF 94 
0F9F 



SETAr/m8 
SETAE r/mS 
SETB r/mS 
SETBE r/mS 
SETCr/m8 
SETEr/mS 
SETGr/mS 



ITS 

Clocks 

436 386 

4/3 4/5 

4/3 4/5 

4/3 4/5 

4/3 4/5 

4/3 4/5 

4/3 4/5 

4/3 4/5 



Description 

Set byte if above (CF=0 and ZF=0) 

Set byte if above or equal (CF=0) 

Set byte if below (CF=1) 

Set byte if below or equal (CF=1 or ZF=1) 

Set if carry (CF=1) 

Set byte if equal (ZF=1) 

Set byte if greater (ZF=0 or SF=OF) 
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Opcode Instruction 



Clocks Description 







486 


386 


0F9D 


SETGE r/m8 


4/3 


4/5 


0F9C 


SETL r/mS 


4/3 


4/5 


0F9E 


SETLE r/mS 


4/3 


4/5 


OF 96 


SETNAr/mS 


4/3 


4/5 


OF 92 


SETNAE r/mS 


4/3 


4/5 


OF 93 


SETNB r/mS 


4/3 


4/5 


OF 97 


SETNBE r/m8 


4/3 


4/5 


OF 93 


SETNC r/m8 


4/3 


4/5 


OF 95 


SEINE r/m8 


4/3 


4/5 


0F9E 


SETNGr/m8 


4/3 


4/5 


0F9C 


SETNGE r/m8 


4/3 


4/5 


0F9D 


SETNL r/m8 


4/3 


4/5 


0F9F 


SETNLE r/m8 


4/3 


4/5 


OF 91 


SETNO r/m8 


4/3 


4/5 


0F9B 


SETNP r/m8 


4/3 


4/5 


OF 99 


SETNSr/m8 


4/3 


4/5 


OF 95 


SETNZr/m8 


4/3 


4/5 


OF 90 


SETOr/m8 


4/3 


4/5 


0F9A 


SETP r/m8 


4/3 


4/5 


0F9A 


SElFEr/m8 


4/3 


4/5 


0F9B 


SETPO r/m8 


4/3 


4/5 


OF 98 


SETSr/m8 


4/3 


4/5 


OF 94 


SETZ r/m8 


4/3 


4/5 



Set byte if greater or equal (SF=OF) 

Set byte if less (SFoOF) 

Set byte if less or equal (ZF=1 and SFoOF) 

Set byte if not above (CF=1) 

Set byte if not above or equal (CF=1) 

Set byte if not belowr (CF=0) 

Set byte if not below or equal (CF=0 and ZF=0) 

Set byte if not carry (CF=0) 

Set byte if not equal (ZF=0) 

Set byte if not greater (ZF=1 or SFoOF) 

Set byte if not greater or equal (SFoOF) 

Set byte if not less (SF=OF) 

Set bjrte if not less or equal (ZF=1 and SFoOF) 

Set byte if not overflow (OF=0) 

Set byte if not parity (PF=0) 

Set byte if not sign (SF=0) 

Set byte if not zero (ZF=0) 

Set byte if overflow (OF=l) 

Set byte if parity (PF=1) 

Set b)^e if parity even (PF=1) 

Set byte if parity odd (PF=0) 

Set byte if sign (SF=1) 

Set byte if zero (ZF=1) 



SETcc stores a byte containing 1 at 
address or register if the condition 



the destination specified by the effective 
is met, or a byte if the condition is not met. 



SGDT 
SIDT 



Store global/interrupt descriptor table 
80286 and greater protected mode only 



Opcode Instruction 



OF 01/0 
OF 01 /I 



SGDTm 
SlDTm 



486 

10 
10 



Clocks 

386 286 

9 11 

9 12 



Description 

Store GDTR torn 
Store IDTR torn 



SGDT/SIDT copies the contents of the descriptor table register to the six bytes 
of memory indicated by the operand. The LIMIT field of Ihe register is assigned 
to the first word at the effective address. If the operand-size attribute is 16 bits, 
the next three bytes are assigned the BASE field of the register, and the fourth 
byte is written with zero. The last byte is undefined. Otherwise, if the operand- 
size attribute is 32 bits, the next four bytes are assigned the 32-bit BASE field of 
the register. 

•SGDT and SIDT are used only in operating system software; they are not used 
in application programs. 
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SHLD 



Double precision sliift left 
386 processors and greater 



ITS 



A P 



Opcode Instruction 



Clocks Description 

486 386 



0FA4 


SHLD r/ml6,rl6,imm8 


2/3 


3/7 


r/ml6 gets SHL of r/ml6 concatenated 
with rl6 


0FA4 


SHLD r/m32,r32,imm8 


2/3 


3/7 


r/m32 gets SHL of r/m32 concatenated 
withr32 


0FA5 


SHLDr/ml6,rl6,CL 


2/3 


3/7 


r/inl6 gets SHL of r/ml6 concatenated 
with rl6 


0FA5 


SHLDr/m32,r32,CL 


2/3 


3/7 


r/m32 gets SHL of r/m32 concatenated 
withr32 



SHLD shifts the first operand provided by the r/m field to the left as mariy bits 
as specified by the count operand. The second operand (rl6 or r32) provides the 
bits to shift in from the right (starting with bit 0). The result is stored back into 
the r/m. operand. The register remains unaltered. 

The count operand is provided by either an unmediate byte or the contents of 
the CL register. These operands are taken MODULO 32 to provide a ntmiber 
between and 31 by which to shift. Because the bits to shift are provided by the 
specified registers, the operation is useful for multiprecision shifts (64 bits or 
more). The SF, ZF and PF flags are set according to the value of the result. CF is 
set to the value of the last bit shifted out. OF and AF are left undefined. 



SHRD 



Double precision shift right 
386 processors and greater 



D 



Opcode instruction 



Clocks Description 

486 386 



OF AC SHRD r/ml6,rl6,imin8 2/3 3/7 r/ml6 gets SHR of r/ml6 concatenated 

withrlb 

OF AC SHRD r/m32,r32,imm8 2/3 3/7 r/m32 gets SHR of r/m32 concatenated 

with r32 



OF AD SHRD r/ml6,rl6,CL 
OF AD SHRD r/m32,r32,CL 



3/4 3/7 r/ml6 gets SHR of r/ml6 concatenated 
with rlo 

3/4 3/7 r/m32 gets SHR of r /m32 concatenated 
withr32 



SHRD shifts the first operand provided by the r/m. field to the right as many 
bits as specified by the count operand. The second operand (rl6 or r32) 
provides the bits to shift in from the left (starting with bit 31). The result is 
stored back into the r/m operand. The register remaii\s unaltered. 

The count operand is provided by either an immediate byte or the contents of 
the CL register. These operands are taken MODULO 32 to provide a number 
between and 31 by which to shift. Because the bits to shift are provided by the 
specified register, the operation is useful for multi-precision shifts (64 bits or 
more). The SF, ZF and PF flags are set according to the value of the result. CF is 
set to the value of the last bit shifted out. OF and AF are left undefined. 



Chapter 4, Processor instructions 127 



SLOT Store local descriptor table register 

80286 and greater protected mode only 



ODITSZAPC 

Opcode Instruction Clocks Description 

486 386 286 

OF 00/0 SLDTr/ml6 2/3 pm=2/2 2/3 Store LDTR to EA word 

SLDT stores the Local Descriptor Table Register (LDTR) in the two-byte register 
or memory location indicated by the effective address operand. This register is 
a selector that points into the global descriptor table. 

SLDT is used only in operating system software. It is not used in application 
programs. 

SMSW Store machine status word 

80286 and greater protected mode only 

ODITSZAPC 

Opcode Instruction Clocks Description 

486 386 286 

OF 01/4 SMSWr/ml6 2/3 2/3,pm=2/2 2/3 Store machine status word to EA 

word 

SMSW stores the machine status word (part of CRO) in the two-byte register or 
memory location indicated by the effective address operand. 



STC Set carry flag 



ODITSZAPC 

1 

Opcode Instruction Clocks Description 

486 386 286 86 

F9 STC 2 2 2 2 Setcarryflag 

STC sets the carry flag to 1. 

STD Set direction flag 



ODITSZAPC 
1 

Opcode Instruction Clocks Description 

486 386 286 86 

FD STD 2 2 2 2 Set direction flag so (E)SI or (E)DI 

decrement 

STD sets the direction flag to 1, causing all subsequent string operations to 
decremient the index registers, (E)SI and/or (E)DI, on which they operate. 
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STI Set interrupt enable flag 



ODITSZAPC 
1 

Opcode Instruction Clocks Description 

486 386 286 86 

FB STI 5 3 2 2 Set interrupt flag 

STI sets the interrupt flag to 1. The CPU then responds to external interrupts 
after executing the next instruction if the next instruction allows the interrupt 
flag to remain enabled. If external interrupts are disabled and you code STI, 
RET (such as at the end of a subroutine), the RET is allowed to execute before 
external interrupts are recogruzed. Also, if external interrupts are disabled and 
you code STI, CLI, then external interrupts are not recognized because the CLI 
instruction clears the interrupt flag during its execution. 

STOS Store string data 

STOSB STOSD 386 processors and greater 

STOSW ODITSZAPC 



STOSD 



Opcode Instruction Clocks Description 

486 386 286 86 

AA STOSmS 5 4 3 11 Store AL mbyte ES:[(E)DI] 

AB STOSml6 5 4 3 11 Store AX in word ES:[(E)DI] 

AB STOSm32 5 4 Store EAX in dword ES:[(E)DI] 

AA STOSB 5 4 3 11 Store AL in byte ES:[(E)DI] 

AB STOSW 5 4 3 11 Store AX in word ES:[(E)DI] 

AB STOSD 5 4 Store EAX in dword ES:[(E)DI] 

STOS transfers the contents of the AL, AX, or EAX register to the memory byte, 
word, or doubleword given by the destination register relative to the ES 
segment. The destination register is DI for an address-size attribute of 16 bits or 
EDI for an address-size attribute of 32 bits. 

The destination operand must be addressable from the ES register. A segment 
override is not possible. 

The address of the destination is determined by the contents of the destination 
register, not by the explicit operand of STOS. this operand is used only to 
validate ES segment addressability and to determine the data type. Load the 
correct index value into the destination register before executing STOS. 

After the transfer is made, DI is automatically updated. If the direction flag is 
(CLD was executed), DI is incremented; if the direction flag is 1 (STD was 
executed), DI is decremented. DI is incremented or decremented by 1 if a byte is 
stored, by 2 if a word is stored, or by 4 if a doubleword is stored. 

STOSB, STOSW, and STOSD are synonyms for the byte, word, and double- 
word STOS instructions, that do not require an operand. They are simpler to 
use, but provide no type or segment checking. 

STOS can be preceded by the REP prefix for a block fill of CX or ECX bytes, 
words, or doublewords. Refer to the REP instruction for further details. 
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STR Store task register 

80286 and greater protected mode only 

ODITSZAPC 

Opcode Instruction Clocks Description 

486 386 286 

OF 00 /I STRr/ml6 2/3 pm=23/27 2/3 Load EA word into task register 

The contents of the task register are copied to the two-byte register or memory 
location indicated by the effective address operand. 

STR is used only in operating system software. It is not used in application 
programs. 



SUB 



integer Subtraction 





D 


I T 


S Z 


A 


P C 






* 




* * 


* 


* * 




Opcode 


Instruction 




( 


"locks 




Description 






486 


386 


286 


86 




2Cib 


SUBAL,iimn8 


,«1 


2 


3 


4 


Subtract inunediate byte 
from AL 


2Diw 


SUB AX,iimnl6 


1 


2 


3 


4 


Subtract immediate word 
from AX 


2D id 


SUBEAX,iimn32 


1 


2 






Subtract immediate dword 
fromEAX 


80/5ib 


SUB r/m8,iiran8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract immediate byte 
from r/m byte 


81 /5 iw 


SUB r/ml6,imml6 


1/3 


2/7 


3/7 


4/17+EA 


Subtract immediate word 
from r/m word 


81 /5 id 


SUB r/m32,iirun32 


1/3 


2/7 






Subtract immediate dword 
from r/m dword 


83/5ib 


SUB r/ml6,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract sign-extended 
immediate Dyte from r/m 
word 


83/5ib 


SUB r/m32,imm8 


1/3 


2/7 






Subtract sign-extended 
immediate Dyte from r/m 
dword 


28 /r 


SUB r/m8,r8 


1/3 


2/6 


2/7 


3/16+EA 


Subtract byte register from 
r/m byte 


29 /r 


SUB r/ml6,rl6 


1/3 


2/6 


2/7 


3/16+EA 


Subtract word register from 
r/m word 


29 /r 


SUBr/m32^32 


1/3 


2/6 






Subtract dword register from 
r/m dword 


2A/r 


SUB r8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


Subtract EA byte from byte 
register 


2B/r 


SUB rl6,r/m32 


1/2 


2/7 


2/7 


3/9+EA 


Subtract EA word from word 
register 


2B/r 


SUBr32,r/m32 


1/2 


2/7 






Subtract EA dword from 
dword register 



SUB subtracts the second operand (SRC) from the first operand (DEST). The 
first operand is assigned the result of the subtraction, and the flags are set 
accordingly. 

When an immediate byte value is subtracted from a word operand, the 
immediate value is first sign-extended to the size of the destination operand. 
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TEST 



Logical compare 





D I 


T 


S Z 


A P 


C 











* * 


? * 







Opcode 


Instruction 


486 




Clocks 


86 


Description 




386 


286 




A8ib 


TEST AL,iirun8 


1 


2 


3 


4 


And immediate byte with 
AL 


A9iw 


TESTAX,inunl6 


1 


2 


3 


4 


And immediate word with 
AX 


A9id 


TESTEAX,iinm32 


1 


2 






And immediate dword 
withEAX 


F6/0ib 


TESTr/m8,imin8 


1/2 


2/5 


3/6 


5/11+EA 


And immediate byte with 
r/mbyte 


F7 /O iw 


TEST r/ml6,iimnl6 


1/2 


2/5 


3/6 


5/11+EA 


And immediate word with 
r/m word 


F7/0id 


TEST r/m32,imin32 


1/2 


2/5 






And immediate dword 
with r/m dword 


84 /r 


TESTr/m8,r8 


1/2 


2/5 


2/6 


3/9+EA 


And byte register with r/m 
byte 


85 /r 


TESTr/ml6,rl6 


1/2 


2/5 


2/6 


3/9+EA 


And word register with 
r/m word 


85 /r 


TESTr/m32,r32 


1/2 


2/5 






And dword register with 
r/m dword 



TEST computes the bit-wise logical AND of its two operands. Each bit of the 
result is 1 if both of the corresponding bits of the operands are 1; otherwise, 
each bit is 0. The result of the operation is discarded and only the flags are 
modified. 

The optimized form of TEST is TESTFLAG (see Chapter 3). 



VERR 
VERW 



Verify a segment for reading or writing 
80286 and greater protected mode only 



Opcode Instruction Clocks Description 

486 386 286 

OFOO/4 VERRr/ml6 11/11 pm=10/ll 14/16 Set ZF=1 if segment can be read 

OF 00/5 VERWr/ml6 11/11 pm=15/16 14/16 Set ZF=1 if segment can be written 

The two-byte register or memory operand of VERR and VERW contains the 
value of a selector. VERR and VERW determine whether the segment denoted 
by the selector is reachable from the current privilege level and whether the 
segment is readable (VERR) or writable (VERW). If the segment is accessible/ 
the zero flag is set to 1; if the segment is not accessible, the zero flag is set to 0. 
To set ZF, the following conditioris must be met: 

• The selector must denote a descriptor within the bounds of the table (GDT or 
LDT); the selector must be "defined." 

• The selector must denote the descriptor of a code or data segment (not that 
of a task state segment, LDT, or a gate). 

• For VERR, the segment must be readable. For VERW, the segment must be a 
writable data segment. 
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• If the code segment is readable and conforming, the descriptor privilege 
level (DPL) can be any value for VERR. Otherwise, the DPL must be greater 
than or equal to (have less or the same privilege as) both the current 
privilege level and the selector's RPL. 

The validation performed is the same as if the segment vv^ere loaded into DS, ES, 
FS, or GS, and the indicated access (read or write) were performed. The zero 
flag receives the result of the validation. The selector's value cannot result in a 
protection exception, enabling the software to anticipate possible segment 
access problemiS. 

WAIT Wait until BUSY# pin is inactive (HIGH) 



Opcode Tnstruction Clocks Description 

486 386 286 86 

9B WAIT 1-3 6 3 4+5n Wait until BUSY pin is inactive (HIGH) 

WAIT suspends execution of CPU instructions until the BUSY# pin is inactive 
(high). The BUSY# pin is driven by the 80x87 numeric processor extension. 

WBIN VD Write-back and Invalidate cache 

i486 processors and greater 

ODITSZAPC 

Opcode Instruction Clock Description 

486 

OF 09 WBINVD 5 Write-back and invalidate entire cache 

The internal cache is flushed, and a special-function bus cycle is issued which 
indicates that the external cache should write-back its contents to main 
memory. Another special-function bus cycle follows, directing the external 
cache to flush itself. 

Note: This instruction is implementation-dependent; its function might be 
implemented differently on future Intel processors. It is the responsibility of the 
hardware to respond to the external cache write-back and flush indications. 

WRMSR Write to Model Specific Register 

Pentium processors and greater 



Opcode Instruction Clocks Description 

Pentium 

OF 30 WRMSR 30-45 Write the value in EDX:EAX to Model Specific 

Register indicated by ECX. 

The value in ECX specifies one of the 64-bit Model Specific Registers of the 
Pentium processor. The contents of EDX:EAX is copied into that Model Specific 
Register. The high-order 32 bits are copied from EDX and the low-order 32 bits 
are copied from EAX. 
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The following values are used to select model specific registers on the Pentium 
processor: 

Value (in Hex) Register Name Description 

OOh Machine Check Address Stores address of cycle causing the exception. 

Olh Machine Check Type Stores cycle type of cycle causing the exception. 

Other values used to preform cache, TLB and BTB testing and performance 
monitoring, are available imder a non-disclosure agreement from Intel. 

Protected mode exceptions: #GP(0) if either the current privilege level is not or 
the value in ECX does not specify a Model-Specific Register that is 
implemented in the Pentitim processor. 

Real mode exceptions: #GP if the value in ECX does not specify a Model- 
Specific Register that is implemented in the Pentium processor. 

Virtual 8086 mode exceptions: #GP(0) if instruction execution is attempted. 

Notes; This instruction must be executed at privilege level or in real-address 
mode; otherwise a protection exception will be generated. 

Always set xmdefined or reserved bits to the value previously read. 

WRMSR is used to write the content of Model-Specific Registers that control 
functions for testability, execution tracing, performance monitoring and 
machine check errors. Refer to the Pentium Processor Data Book for more 
information or contact Intel. 

The values 3h, OFh, and values above 13h are reserved. Do not execute WRMSR 
with reserved values in ECX. 

XADD Exchange and add 

i486 processors and greater 

ODITSZAPC 



Opcode Instruction Clock Description 

486 

OFCO/r XADDr/m8,r8 3/4 Exchange byte register and r/mbjrte; load sum 

into r/m byte. 

OFCl/r XADD r/ml6,rl68 3/4 Exchange word register and r/m word; load sum 

into r/m word. 

OFCl/r XADD r/m32,r32 3/4 Exchange dword register and r/m dword; load 

simi into r/m dword. 

The XADD instruction loads DEST into SRC, and then loads the sum of DEST 
and the original value of SRC into DEST. 

DEST is the destination operand; SRC is the source operand. 

Protected mode exceptions: #GP(0) if the result is in a nonwritable segment; 
#GP(0) for an illegal memory operand effective address in the CS, DS, ES, FS, or 
GS segments; #SS(0) for an illegal address in the SS segment; #PF (fault code) for 
a page fault; #NM if either EM or TS in CRO is set; #AC for an unaligned 
memory reference if the current privilege level is 3. 

Real address mode exceptions: interrupt 13 if any part of the operand would lie 
outside the effective address space from to OFFITh. 
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Virtual 8086 mode exceptions: same exception as in real-address mode; same 
#PF and #AC exceptions as in protected mode. 



XCHG 



Exchange memory/register with register 








D I 


T 


S Z 


A P 


C 


Oprodc 


Instruction 


486 


386 


Clocks 

286 


86 


Description 






86 /r 


XCHGr/m8^8 


3/5 


3/5 


3/5 


4/17+EA 


Exchange byte register with EA byte 


86 /r 


XCHGr8,r/m8 


3/5 


3/5 


3/5 


4/17+EA 


Exchange byte with EA byte register 


87 /r 


XCHG r/ml6,rl6 3/5 


3/5 


3/5 


4/17+EA 


Exchange word register with EA 
word 


87 /r 


XCHGrl6,r/ml6 3/5 


3/5 


3/5 


4/17+EA 


Exchange word register with EA 
word 


87 A 


XCHGr/in32,r32 3/5 


3/5 






Exchange dword register with EA 
dword 


87 /r 


XCHGr32,r/m32 3/5 


3/5 






Exchange dword register with EA 
dword 


90+ r 


XCHGAX;rl6 


3 


3 


3 


3 


Exchange word register with AX 


90+ r 


XCHGrl6,AX 


3 


3 


3 


3 


Exchange word register with AX 


90+ r 


XCHG EAX,r32 


3 


3 






Exchange dword register with EAX 


90+ r 


XCHGr32,EAX 


3 


3 






Exchange dword register with EAX 



XCHG exchanges two operands. The operands can be in either order. If a 
memory operand is involved, BUS LOCK is asserted for the duration of the 
exchange, regardless of the presence or absence of the LOCK prefix or of the 
value of the lOPL. 



XLAT 
XLATB 



Table look-up translation 



opcode Instruction Clocks 

486 386 286 86 

XLATmS 4 5 5 



Description 



D7 
D7 



XLATB 



11 Set AL to memory byte DS:[(E)BX + unsigned 
AL] 

11 Set AL to niemory byte DS:[(E)BX + imsigned 
AL] 



XLAT changes the AL register from the table index to the table entry. AL 
should be the unsigned index into a table addressed by DS:BX (for an address- 
size attribute of 16 bits) or DS:EBX (for an address-size attribute of 32 bits). 

The operand to XLAT allows for the possibility of a segment override. XLAT 
uses the contents of BX even if they differ from the offset of the operand. The 
offset of the operand should have been moved into BX/EBX with a previous 
instruction. 

The no-operand form, XLATB, can be used if the BX/EBX table will always 
reside in the DS segment. 
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XOR 



Logical exclusive OR 





D 


I T 


' S 


Z 


A P C 







Instruction 




* 


* 
Cloc 


? * 




Opcode 


ks 


Description 






486 


386 


286 


86 




34 ib 


XORAL,imm8 


1 


2 


3 


4 


Exclusive-OR immediate bjMie 
toAL 


35 iw 


XORAX,imml6 


1 


2 


3 


4 


Exclusive-OR immediate word 
to AX 


35 id 


XOREAX,imm32 


1 


2 






Exclusive-OR immediate 
dword to EAX 


80/6ib 


XORr/m8,iJtnm8 


1/3 


2/7 


3/7 


4/17+EA 


Exclusive-OR inunediate byte 
to r/m byte 


81 /6 iw 


XORr/ml6,imml6 


1/3 


2/7 


3/7 


4/17+EA 


Exclusive-OR immediate word 
to r/m word 


81/6 id 


XORr/m32,imm32 


1/3 


2/7 






Exclusive-OR immediate 
dword to r/m dword 


83/6ib 


XORr/ml6,imm8 


1/3 


2/7 






XOR sign-extended immediate 
byte to r/m word 


83/6ib 


XORr/m32,imm8 


1/3 


2/7 






XOR sign-extended immediate 
byte to r/m dword 


30 /r 


XORr/m,r8 


1/3 


2/6 


2/7 


3/16+EA 


Exclusive-OR byte register to 
r/m byte 


31 /r 


XORr/inl6,rl6 


1/3 


2/6 


2/7 


3/16+EA 


Exclusive-OR word register into 
r/m word 


31 /r 


XORr/in32,r32 


1/3 


2/6 






Exclusive-OR dword register to 
r/m dword 


32 /r 


XORr8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


Exclusive-OR r/m byte to byte 
register 


33 /r 


XORrl6,r/ml6 


1/2 


2/7 


2/7 


3/9+EA 


Exclusive-OR r/m word to 
word register 


33 /r 


XORr32,r/m32 


1/2 


2/7 






Exclusive-OR to r/m dword to 
dword register 



XOR computes the exclusive OR of the two operands. Each bit of the result is 
1 if the corresponding bits of the operands are different; each bit is if the 
corresponding bits are the same, llie answer replaces the first operand. 

The optimized form of XOR is FLIPFLAG (see Chapter 3). 
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Chapter 



Coprocessor instructions 



This chapter lists the 80x87 instructions in alphabetical order. 

There is one entry for each combination of operand types that can be coded 
with the mnemonic. The following table explains the operand identifiers used 
in this section: 

Identifier Explanation 

ST Stack top; the register currently at the top of the stack. 

ST(1) A register in the stack i{0<i<7) stack elements from the top. ST(1) is the 

next-on-stack register, ST(2) is below ST(1), etc. 

m32real A short real (32 bits) number in memory. 

m64real A long real (64 bits) nvimber in memory. 

mSOreal A temporary real (80 bits) number in memory. 

mSOdec A packed decimal integer (18 digits, 10 bj^es) in nnemory. 

ml6int A word binary integer (16 bits) in memory. 

m32int A short binary integer (32 bits) in memory. 

m64int A long binary integer (64 bits) in memory. 

m:)c:rbyte A memory area xx bytes long. 

Here is a summary of the possible exceptions each instruction can cause: 

IS = invalid operand due to stack overflow/underflow 

I = invalid operand due to other cause 

D = denormal operand 

Z = zero-divide 

O = Overflow 

U = Underflow 

P = Inexact result (precision) 
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F2XM1 



Operands 



D9F0 



Compute 2^^ 1 
Exceptions: P, U, D, I, IS 

F2XM1 (no operands) 



F2XM1 



Execution clocks 

87 287 387 

211-476 211^76 



486 586 

242(140-279) 13-57 



FABS 



Operands 



Absolute value 



Exceptions: IS 

FABS (no operands) 



87 



No operands 10-17 



Execution clocks 

287 387 486 

10-17 22 3 2 



FABS 



FADD 



Add real 



Exceptions: I, D, 0, U, P, IS 

FADD destination, source 



Operands 




Execution clocks 




Code 


bytes 


Example 




87 


287 


387 


486 








ST,ST(i) 


70-100 


70-100 


23-34 


10(8-20) 


2 




FADDST^T(4) 


ST(i),ST 














FADDST(2),ST 


short real 


90-120+EA 


90-120 


24^2 


10(^-20) 


2-4 




FADDAIR_TEMP[SI] 


long real 


95-125+EA 


95-125 


29-37 


10(8-20) 


2-4 




FADD [BX].MEAN 


FADDP 


Add real and 


Ipop 











Exceptions: I, D, 0, U, P, IS 

FADDP destination, source 



Operands 



Execution clocks 

87 287 387 486 

ST(i),ST 75-105 75-105 23-^ 10(8^-20) 2 



Code bytes Example 

FADDP ST(2),ST 



FBLD 


Packed decimal (BCD) load 








Exceptions: 1 

FBLD source 






Operands 


Execution clocks 

87 287 387 486 


Code 
bytes 


r\ample 


Packed decimal 


290-310 290-310 5 75(70-103) 


2-4 


FBLDYTD_SALES 
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FBSTP 



Packed decimal (BCD) store and pop 







Exceptions: 1 










FBSTP destination 






operands 




Execution clocks 




Code 

bytes Example 




87 


287 387 


486 




Packed 
decimal 


520-540+EA 520-540+EA 512-534 


175(172-176) 2-4 FBSTP 

[BX].FORECAST 


FCHS 




Change sign 








Exceptions: 1 










FCHS (no operands) 


Code b; 




Operands 


Execution clocks 


ytes Example 




87 


287 387 486 






No operandi 


; 10-17 10-17 24-25 6 


2 


FCHS 


FCLEX 




Clear exceptions 






FNCLEX 


Exceptions: None 










FCLEX/FNCLEX (no operands) 




operands 




Execution clocks Code bytes 

287 387 486 


Example 




87 




No operands 


3 2-8 


2-8 11 7 




FNCLEX 


FCOM 




Compare real 








Exceptions: 1, D 










FCOM //source 






I )perands 


87 


Execution clocks 

287 387 486 


Code 
bytes 


Example 


//ST(i) 


40-50 


40-50 24 4 




FCOMST(l) 


short real 


60-70+EA 60-70 26 4 


2-4 


FCOM [BP].UPPER_LIM1T 


long real 


65-75+EA 65-75 31 4 


2-4 


FCOM WAVELENGTH 


FCOMP 




Compare real and pop 








Exceptions: 1, D 










FCOMP //source 






Operands 


87 


Execution clocks 

287 387 486 


Code 
bytes 


Example 


//St(i) 


42-52 


45-52 26 4 


2 


FCOMP ST(2) 


short real 


63-73+EA 63-73 26 4 


2-4 


FCOMP [BP+2].N_READINGS 


long real 


67-77+EA 67-77 31 4 


2-4 


FCOMP DENSITY 
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FCOMPP Compare real and pop twice 







Exceptions: 1, D 












FCOMPP (no operands) 








Op«.*r.indh 


87 


Fxecution clocks 

287 387 486 


Codi 


! bytes 


Example 


No operands 


45-55 45-55 26 5 


2 




FCOMPP 


FCOS 




Cosine of ST(0) 
80387 and greater 










Exceptions: IS, i, D, U, P 












FCOS 








Operands 


87 


Lxccution clucks 

287 387 486 




Code 
bylos 


Example 


No operands 




123-772* 241(193-279) 


2 


FCOS 



*These timings hold for operands in the range I x I /4. For operands not in this range, up to 76 
additional clocks may be needed to reduce the operand. 

FDECSTP Decrement s tack pointer _^ 

Exceptions: None 

FDECSTP (no operands) 



Operands Execution clocks 

87 287 387 486 

No operands 6-12 6-12 22 3 



Code bytes Example 



FDECSTP 



FDISI 
FNDISI 



Operands 

No operands 



Disable interrupts 
8087 only 



Exceptions: None 

FDISI (no operands) 

Operand word 
Execution clocks transfers 

Typical Range 

5 2-8 



Code bytes Example 



FDISI 



FDIV 



Divide real 



Exceptions: i, D, Z, 0, U, P 

FDIV //source/destination, source 



Operands Execution clocks 

87 287 387 486 

//ST(i),ST 193-203 193-203 88-91 73 

short real 215-225 215-225 89 73 



Code bytes Example 



2 
2-4 



FDIV 

FDIV DISTANCE 



140 Turbo Assembler Quick Reference 



Operands 

long real 
//ST,ST(i) 



87 
220-230 



Execution clocks 

287 387 

220-230 94 



486 

73 
73 



Code bytes Example 

2-4 FDIVARC[DI] 



FDIVP 



Operands 



Divide real and pop 



Exceptions: I, D, Z, 0, U, P 

FDIVP destination, soxirce 



Execution clocks 

87 287 387 486 

//ST(i),ST 197-207 198-209 88-91 73 



Code bytes Cxample 

2 FDIVP ST(4),ST 



FDIVR 



Divide real reversed 



Exceptions: I, D, Z, 0, U, P 

FDIVR //source /destination, source 



Operand*- 


Execution clocks 

87 287 387 486 


Code 
bytes 


Example 








II 
ST,ST(i)/ 


194-204 198-208 88-91 73 


2 


FDIVR ST(2),ST 


ST(i),ST 


73 






short real 


216-226+EA 215-225 89 73 


2-4 


FDIVR [BX].FULSE_RATE 


long real 


221-231+EA 220-230 94 73 


2-4 


FDIVR RECORDER.FREQUENCY 


FDIVRP 


Divide real reversed and pop 





Exceptions: I, D, Z, 0, U, P 

FDIVRP destination, source 



Operands 



Execution clocks 

87 287 387 486 

ST(i),ST 198-208 198-208 88-91 73 



Code bytes Example 

2 FDIVRP ST(1),ST 



FENI 
FNENI 



operands 

(no operands) 



Enable interrupts 
8087 only 



Exceptions: None 

FENI (no operands) 

Execution clock Code bytes Example 

87 

5(2-8) 2 FNENI 
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FFREE 



Free register 





Exceptions: None 










FFREE destination 








Operands 


Execution clucks 

87 287 387 486 


Code 


bytes 


Example 










ST(i) 


9-16 9-16 18 3 


2 




FFREE ST(1) 


FIADD 


Integer add 










Exceptions: 1, D, 0, P 










FIADD source 




Code 
bytes 




Operands 


Execution clocks 


Example 




87 287 387 486 








word 
integer 


102-137+EA 102-137 71-85 22.5(19-32) 


2-4 


FIADD 
DISTANCE_TRAVELLED 


short 
integer 


108-143+EA 108-143 57-72 24(20-35) 


2-4 


FIADD PULSE_COUNT [SI] 


FICOM 


Integer compare 









Exceptions: I, D 

FICOM source 



Operands 



word 
integer 

short 
integer 



Code 

bytes Example 



Execution clocks 

87 287 387 486 

72-86+EA 72-^6 71-75 18(16-20) 2-4 HCOM TOOL.N_FASSES 

78-91+EA 78-91 56-63 16.5(15-17) 2-4 HCOM [BP+4].PARM_COUNT 



FICOMP 



Integer compare and pop 



Exceptions: I, D 

FICOMP source 



Operands 



word 
integer 

short 
integer 



Execution clocks 

87 287 387 486 

74-88+EA 74-88 71-75 18(16-20) 

80-93+EA 80-93 56-63 16.5(15-17) 



Code 

bytes Example 



2-4 FICOMP [BP].LIMrr [SI] 

2-4 FICOMP N SAMPLES 
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FIDIV 



Operands 



Integer divide 



Exceptions: I, D, Z, 0, U, P 

FIDIV source 



Code 

bytes Example 



Execution clocks 

87 287 387 486 

224-238+EA 224-238 136-140 73 2-4 FIDIV SURVEY.OBSERVATIONS 



word 
integer 

short 230-243+EA 230-243 120-127 73 2-4 FIDIV RELATIVE_ANGLE [DI] 

mteger 



FIDIVR 



operands 



Integer divide reversed 



Exceptions: I, D, Z, 0, U, P 

FIDIVR source 



Code 

bytes Example 



Execution clocks 

87 287 387 486 

word mteger 225-239+EA 224-238 135-141 73 2-4 HDIVR [BP].X_COORD 

short integer 231-245-fEA 230-243 121-128 73 2-4 FIDIVR FREQUENCY 



FILD 



Operands 



Integer load 



87 



Exceptions: I 

FILD source 

Execution clocks 

287 387 486 



Code 

bytes Example 



word 46-54-(-EA 46-54 61-65 11.5(9-12) 2-4 

integer 

short 52-60+EA 52-60 45-52 14.5(13-16) 2-4 

integer 

long 60-68+EA 60-68 56-67 16.8(10-18) 2-4 

integer 



FILD [BX].SEQUENCE 
FILD STANDOFF [DI] 
FILD RESPONSE.COUNT 



FIMUL 



Integer multiply 



Exceptions: I, D, 0, P 

FIMUL source 

Code 
Operands Execution clocks bytes Example 

87 287 387 486 

word integer 124H38-HEA 12^138 76-87 8 2-4 FIMUL BEARING 

short integer 130-144-i-EA 130-144 61-82 8 2-4 FIMUL POSmON.Z_AXIS 
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FINCSTP 

Operands 

No operands 



Increment stack pointer 



Exceptions: None 

FINCSTP (no operands) 

1-Accuti(in clocks 

87 287 387 486 

6-12 6-12 21 3 



Ci)de bytes LK.implo 



FINCSTP 



FINIT 
FNINIT 

Operands 

87 
No operands 2-8 



Initialize processor 



Exceptions: None 

FINIT/FNINIT (no operands) 



Execution clocks 

287 387 486 

2-8 33 17 



Code bytes Example 



FINIT 



FIST 



Upcr.inds 



word 
integer 

short 
integer 



Integer Store 



Exceptions: I, P 

FIST destination 



Code 

bytes Example 



txeciition ciDLks 

87 287 387 486 

80-90+EA 80-90 82-95 33.4(29-34) 2-4 FIST OBS.COUNT [SI] 

82-92+EA 82-92 79-93 32.4(28-34) 2-4 HST [BP;].FACTORED_PULSES 



FISTP 



Operands 



word 
integer 

short 
integer 

long 
integer 



Integer store and pop 



Exceptions: i, P 

FISTP destination 

Execution clocks 

287 387 486 



Code 

bytes Example 



87 

82-92+EA 82-92 82-95 33.4(29-34) 2-4 FISTP [BX]. 

ALPHA_COXJNT [SI] 

84-94+EA 84-94 79-93 33.4(29-34) 2-4 HSTP CORRECTED_TIME 
94-105+EA 94-105 80-97 33.4(29-34) 2-4 HSTP PANEL. N.READINGS 
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FISUB 



operands 



Integer subtract 



87 



Exceptions: I, D, 0, P 
FISUB source 

Execution clocks 

287 387 486 



Code 

bytes Example 



word 102-137+EA 102-137 71-83 22.5(19-32) 2-4 FISUB BASE_FREQUENCY 

integer 

short 108-143+EA 108-143 57-82 24(20-35) 2-4 HSUB TRAIN_S1ZE [DI] 

integer 



FISUBR 



Integer subtract reversed 



Exceptions: I, D, 0, P 

nSUBR source 



Operands Execution clocks 

87 287 387 486 

103-139+EA 102-137 72-84 22.5(19-32) 2-4 



Code ■ 

bytes Example 



word 
integer 

short 109-144+EA 108-143 58-83 24(20-35) 

integer 



2-4 



FISUBR FLOOR [BX][SI] 
FISUBR BALANCE 



FLD 




Load real 










Operands 


Exceptions: 1, D 

FLD source 

Execution clocks 


486 

4 
3 
3 
6 


Code 

2 

2-4 
2-4 
2-4 


bytes 


Example 


ST(i) 

short real 
long real 
Temp real 


87 287 387 

17-22 17-22 14 
38-56+EA 38-56 20 
40-60+EA 40-60 25 
53-65+EA 53-65 44 


FLDST(O) 

FLD READING [SI].FRESSURE 

FLD [BP].TEMPERATURE 

FLDSAVEREADING 


FLDCW 




Load control word 









Exceptions: None 

FLDCW source 



Operands Execution clocks 

87 287 387 486 

2 bytes 7-14+EA 7-14 19 4 



Code bytes Example 



2-4 



FLDCW CONTROL WORD 



Chapter 5, Coprocessor instructions 145 



FLDENV 



Load environment 







Exceptions: None 

FLDENV source 






Operands 


87 


Execution clocks 

287 387 486 




Code 

bytes Example 


14 bytes 


35-45+EA 35-45 71 44 real or 
protected 


virtual 34 


2-4 FLDENV [BP+6] 


FLDLG2 




Load Iogio2 








Exceptions: 1 

FLDLG2 (no operands) 






Operands 


87 


Execution clocks 


Code bytes 


Example 




287 387 486 






No operands 


18-24 18-24 41 8 


2 


FLDLG2 


FLDLN2 




Load 109^2 








Exceptions: 1 

FLDLN2 (no operands) 






Operands 


87 


Execution clocks 

287 387 486 


Code bytes 


Example 


No operands 


17-23 17-23 41 8 


2 


FLDLN2 


FLDL2E 




Load log2e 








Exceptions: 1 

FLDL2E (no operands) 






Operands 


87 


Execution clocks 

287 387 486 


Code bytes 


Example 


No operands 


15-21 15-21 40 8 


2 


FLDL2E 


FLDL2T 




Load 109210 








Exceptions: 1 

FLDL2T (no operands) 






Operands 


87 


Execution clocks 

287 387 486 


Code bytes 


Example 


No operands 


16-22 16-22 40 8 


2 


FLDL2T 
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FLDPI Load P (pi) 

Exceptions: I 

FLDPI (no operands) 

Operands Execution docks 

87 287 387 486 

No operands 16-22 16-22 40 8 



Code bytes Example 



FLDPI 



FLDZ 

Operands 

No operands 



Load +0.0 



Exceptions: I 

FLDZ (no operands) 

Execution clocks 

87 287 387 486 

11-17 11-17 20 4 



Code bytes Example 



FLDZ 



FLD1 

Operands 

No operands 



Load +1.0 



Exceptions: I 

FLDl (no operands) 

Execution clocks 

87 287 387 486 

15-21 15-21 24 4 



Code bytes Example 



FLDl 



FMUL 



Multiply real 



Exceptions: I, D, 0, U, P 

FMUL //source /destination, source 



Operands 


Ex 

87 


ecution clocks 


486 


Code 
bytes 


Example 




287 


387 




//ST(i),ST/ST, 
90-105,ST(1)* 


90-105 


90-145 


29-57 


16 


2 


FMULST,ST(3) 


//ST(i),ST/ST, 
ST,ST(1) 

short real 


130-145 


90-145 


29-57 


16 


2 


FMULST,ST(3) 


110-125+EA 


110-125 


27-35 


11 


2-4 


FMUL SPEED_FACTOR 


long real* 


112-126+EA 


112-168 


32-57 




2-4 


FMUL [BP].HEIGHr 


long real 


154-168+EA 


112-168 


32-57 


14 


2-4 


FMUL [BP].HEIGHT 



*Occurs when one or both operands is "short" — ^it has 40 trailing zeros in its fraction (for 
example, it was loaded from a short-real memory operand). 
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FMULP 



Opcriinds 



Multiply real and pop 



Exceptions: i, D, 0, U, P 

FMULP destination, source 



Exocutidii clocks 

87 287 387 486 

ST(i),ST* 94-108 198-208 29-57 

ST(i),ST 134-148 198-208 29-57 16 



Codebjles Example 



FMULP ST(1),ST 
FMULP ST(1),ST 



*Occiirs when one or both operands is "short" — ^it has 40 trailing zeros in its fraction (for 
example, it was loaded from a short-real memory operand). 



FNOP 



Operands 



No operation 



Exceptions: None 
FNOP (no operands) 



Execution clocks 

87 287 387 486 

No operands 10-16 10-16 12 3 



Code bytes Example 



FNOP 



FPATAN 

Operands 

No operands 



Partial arctangent 



Exceptions: U, P (operands not checlced) 

FPATAN (no operands) 



Execution clocks 

87 287 387 486 

250-800 250-800 314^87 5(2-17) 2 



Code bytes Example 



FPATAN 



FPREM 



Partial remainder 



Exceptions: i, D, U 

FPREM (no operands) 



Operands 




Execution clocks 






87 


287 387 


486 


No operands 


15-190 


15-190 74-155 


2(2-8) 



Code bytes Example 



FPREM 



FPREM1 

Operands 

No operands 



Partial remainder 
80387 and greater 



87 



Exceptions: I, D, U 

FPREM (no operands) 

Execution clocks 

287 387 486 

95-185 94.5(72-167) 2 



Code bytes Example 



FPREMl 
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FPTAN Partial tangent 



Exceptions: I, P (operands not checked) 

FPTAN (no operands) 

Operands Execution docks Code bytes Example 

87 287 387 486 

No operands 30-540 30-540 191-573 244(200-273) 2 FPTAN 



FRNDINT Round to integer 



Exceptions: I, P 

FRNDINT (no operands) 

Operands Execution clocks Code bytes Example 

87 287 387 486 

No operands 16-50 16-50 66-«0 29.1(21-30) 2 FRNDINT 



FRSTOR 


Restore saved state 






Exceptions: None 

FRSTOR source 




Operdndt 


Execution clocks Code bytes 


Example 


. 87 


287 387 486 




94 bytes 197-207+EA 205-215 308 131 real or virtual 120 2-^ 

protected 


FRSTOR 
[BP] 



Note: The 80287 execution clock count for this instruction is not meaningful in determining 
overall instruction execution time. For typical frequency ratios of the 80286 and 80287 clocks, 
80287 execution occurs in parallel with the operand transfers. The operand transfers 
determine the overall execution time of the instructions. For 80286:80287 clock frequency 
ratios of 4:8, 1:1, and 8:5, the overall execution clock count for this instruction is estimated at 
490, 302, and 227 80287 docks, respectively. 

FSAVE Save state 

FNSAVE Exceptions: None 

FSAVE/FNSAVE destination 

Operands Execution clocks Code bvtcs Example 

87 287 387 486 
94 bytes 197-207+EA 205-215 375-376 2-4 FSAVE [BP] 

Note: The 80287 execution clock coxmt for this instruction is not meaningful in determining 
overall instruction execution time. For typical frequency ratios of the 80286 and 80287 clocks, 
80287 execution occurs in parallel with the operand transfers. The operand transfers 
determine the overall execution time of the instruction. For 80286:80287 clock frequency 
ratios of 4:8, 1:1, and 8:5, the overall execution clock count for this instruction is estimated at 
376, 233, and 174 80287 docks, respectively. 
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FSCALE 



Operaunds 



Scale 

Exceptions: 1, 0, U 

FSCALE (no operands) 



Execution clocks 

87 287 387 486 

No operands 32-38 32-38 67-^6 31(30-32) 



Code bytes Example 



FSCALE 



FSETPM 



Set protected mode 



Exceptions: None 

FSETPM (no operands) 



Operands Execution clock Code bytes 

287 
No operands 2-8 2 



Example 

FSETPM 



FSIN 



SineofST(0) 
80387 and greater 



Exceptions: IS, I, D, U, P 

FSIN 

Operanils I \eculiun clocks Code b\tes Lxample 

387 486 
No operands 122-771* 241(193-279) 2 KE^ 

*These timings hold for operands in the range I x I /4. For operands not in this range, up to 76 
additional clocks may be needed to reduce the operand. 



FSINCOS 



Operands 



Sine and cosine of ST(0) 
80387 and greater 



Exceptions: IS, I, D,U, P 

FSINCOS 



Execution clocks 

387 486 

No operands 194r-809* 291(243-329) 2 



Code bytes Example 

FSINCOS 



*These timings hold for operands in the range I x I /4. For operands not in this range, up to 76 
additional clocks may be needed to reduce the operand. 



FSQRT 



Operands 



Square root 



Exceptions: I, D, P 

FSQRT (no operands) 



Execution clocks 

87 287 387 486 

No operands 180-186 180-186 122-129 85.5(83-87) 2 



Code bytes Lxample 

FSQRT 
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FST 



Store real 





Exceptions: 1, 0, U, P 

FST destination 

Execution clocks 

87 287 387 
15-22 15-22 11 
84-90+EA 84r-90 44 
96-104+EA 96-104 45 




( 


Code 
bytes 

2 

2-4 

2-4 




Operands 

ST(i) 
short real 
long real 


486 

,3 
7 
8 


Example 

FSTST(3) 

FST CORRELATION [DI] 

FST MEAN_READING 


FSTCW 


87 
12-18 


Store control word 










FNSTCW 

Operands 

2 bytes 


Exceptions: None 

FSTCW destination 

Execution clocks 

287 387 
;+EA 12-18 15 


486 


Code bytes 

2-4 


Example 

FSTCW SAVE_CONTROL 


FSTENV 


r 

87 
40-50 


Store environment 










FNSTENV 

operands 


Exceptions: None 

FSTENV destination 

Execution clocks 

287 387 
+EA 40-50 103-10-( 






Code b) 

2-4 


'tes Example 


14 bytes 


48e 

1 


) 


FSTENV [BP] 


FSTP 


87 

17-24 
86-92H 

98-10( 

52-58H 


Store real and pop 












Exceptions: 1, 0, U, P 

FSTP destination 










Operands 

ST(i) 
short real 

long real 
Temp real 


Execution clocks 

287 387 
17-24 12 
-EA 86-92 44 

i+EA 98-106 45 
-EA 52-58 53 


486 

3 
7 

8 
6 


Code bytes 

2 
2-4 

2-4 
2-4 


Example 

FSTP ST(2) 

FSTP [BX]. 
ADJUSTED_RPM 

FSTP TOTAL_DOSAGE 

FSTP REG_SAVE [SI] 


FSTSW 


87 
12-li 


Store Status word 










FNSTSW 

Operands 

2 bytes 


Exceptions: None 

FSTSW/FNSTSW destination 

Execution clocks Code bytes 

287 387 486 
B-hEA 12-18 15 3 2-4 


Example 

FSTSW SAVE_STATUS 
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FSTSWAX 
FNSTSWAX 



Store status word to AX 



Operands 



AX 



87 



Exceptions: None 

FSTSW destination 

Execution clocks 

287 387 486 

10-16 13 3 



Code bj^es Example 



FSTSWAX 



FSUB 



Operands 



//ST,ST/(i)/ 
ST(i),ST 

short real 

loiig real 



Subtract real 



Exceptions: I, D, 0, U, P 

FSUB //source/destination, source 



Code 
bytes 



Execution clocks 

87 287 387 486 

70-100 70-100 26-37 7(5-17) 2 

90-120+EA 90-120 24-32 7(5-17) 2-4 

95-125+EA 95-125 28-36 7(5-17) 2-4 



Example 

FSUBST,ST(2) 

FSUB BASE_VALUE 
FSUB COORDINATE.X 



FSUBP 

Operands 

ST(i),ST 



Subtract real and pop 



Exceptions: I, D, 0, U, P 

FSUBP destination, source 



Execution clocks 

87 287 387 486 

75-105 75-105 26-37 7(5-17) 2 



Code bytes 



Example 

FSUBP ST(2),ST 



FSUBR 



Operands 



//ST,ST(i)/ 
ST(i),ST 

short real 

lorig real 



Subtract real reversed 



Exceptions: I, D, 0, U, P 

FSUBR //source/destination, source 



I-\L'culion clocks 

87 287 387 486 

70-100 70-100 26-37 7(5-17) 

90-120+EA 90-120 25-33 7(5-17) 

95-125+EA 95-125 29-37 7(5-17) 



Code 
bytes 


Example 


2 


FSUBR ST,ST(1) 


2-4 
2-4 


FSUBR VECTOR [SI] 
FSUBR [BX].INDEX 



FSUBRP 




Subtract real reversed and pop 






Exceptions: 1, D, 0, U, P 








FSUBRP destination, source 




Operands 




Lxociition clocks C ode bytes 


Example 




87 


287 387 486 




ST(i),ST 


75-105 75-105 26-37 7(5-17) 2 


FSUBRP ST(1),ST 
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FST 



Operands 



Test stack top against +0.0 



Exceptions: I, D 

FIST (no operands) 



Execution clocks 

87 287 387 486 

No operands 38-i8 38-48 28 4 



Code bytes Example 



FTST 



FUCOM 



operands 



Unordered compare 
80387 and greater 



Exceptions: IS, I, D 



Execution clocks Code bytes Example 

387 486 

//ST(i) 24 4 2 FUCOM ST(1) 



FUCOMP 



operands 



Unordered compare 
80387 and greater 



Exceptions: IS, I, D 



Execution clocks Code bytes 

387 486 

//ST(i) 26 4 2 



Example 

FUCOMP ST(2) 



FUCOMPP 



Unordered compare 
80387 and greater 



Exceptions: IS, I, D 



Operands Execution clocks Code bytes 

387 486 

No operands 26 5 2 



Example 



FUCOMPP 



FWAIT 



Wait 



Exceptions: None (CPU instruction) 

FWAIT (no operands) 

Operands Execution clocks Code bytes Example 

387 486 

No operands 3+5n* 1-3 1 FWAIT 

*n = number of time CPU examines BUSY line before 80287 completes execution of previoxis 
instruction. 
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FXAM 



Examine stack top 





Exceptions: None 

FXAM (no operaads) 


Code bytes 

2 




Operands 

No operands 


Execution clocks 

87 287 ' 387 486 

12-23 12-23 30-^8 8 


Example 

FXAM 


FXCH 


Exchange registers 






Operands 

//ST(i) 


Exceptions: 1 

FXCH //destination 

Execution clocks 

87 287 387 486 
10-15 10-15 18 4 


Code bytes 

2 


Example 

FXCHST(2) 


FXTRACT 


Extract exponent and significant 





Exceptions: I 

FXTRACT (no operands) 



Oponinds 



Execution clocks 

87 287 387 486 

No operands 27-55 27-55 70-76 19(16-20) 2 



Code bytes Example 



FXTRACT 



FYL2X 

Operands 

No operands 



/* ioggX 



Exceptions: P (operands not cliecl(ed) 

FYL2X (no operands) 



Execution clocks 

87 287 387 486 

900-1100 900-1100 120-538 311(196-329) 2 



Code bytes Example 



FYL2X 



FYL2XP1 

Operands 

No operands 



y*log2{/+1) 



Exceptions: P (operands not clieci(ed) 

FYL2XP1 (no operands) 



Execution clocks 

87 287 387 486 

700-1000 700-1000 257-547 313(171-326) 2 



Code bytes Example 



FYL2XP1 
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F2XM1 2^ 

Exceptions: U, P (operands not checked) 

F2XM1 (no operands) 

Operands Execution clocks Code bytes Example 

87 287 387 486 

No operands 310-630 310-630 211^76 242(140-279) 2 F2XM1 
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